math/big: add security warning to (*Int).Rand

Change-Id: I22a67733aa2d07298e124077654c9b1473802100 Reviewed-on: https://go-review.googlesource.com/76012 Reviewed-by: Aliaksandr Valialkin <[email protected]> Reviewed-by: Brad Fitzpatrick <[email protected]>
sigma · Nov 6, 2017 · ef0e2af · ef0e2af
1 parent b4c84a1
commit ef0e2af
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/math/big/int.go b/src/math/big/int.go
@@ -644,6 +644,9 @@ func (z *Int) lehmerGCD(a, b *Int) *Int {
 }
 
 // Rand sets z to a pseudo-random number in [0, n) and returns z.
+//
+// As this uses the math/rand package, it must not be used for
+// security-sensitive work. Use crypto/rand.Int instead.
 func (z *Int) Rand(rnd *rand.Rand, n *Int) *Int {
 	z.neg = false
 	if n.neg || len(n.abs) == 0 {