4
votes
Security of PHP's str_shuffle()
Per https://www.php.net/manual/en/function.str-shuffle.php, str_shuffle uses PHP's internal PRNG, which is an implementation of Mersenne Twister (see http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/...
- 52.1k
2
votes
What is the correct way to seed CSPRNG functions?
As anywhere in engineering, there's no "unique" best way; there's always going to be tradeoffs between:
entropy of the source of randomness,
rate of the entropy (i.e. how many bits/second can you get?...
- 6,284
2
votes
Security Risks of Deriving Crypto Wallet Seed Phrases Using Deterministically Derived Salt
This scheme has several major issues.
First off, don't roll your own, i.e., don't try to invent your own cryptographic schemes. There are many ideas which look good on paper but turn out to be fatally ...
- 23.1k
1
vote
Security Risks of Deriving Crypto Wallet Seed Phrases Using Deterministically Derived Salt
The scheme as presented seems more risky to me than it needs to be, because words from the mnemonic phrase are being fed back into a hash-function, and not a password-based key derivation function (...
- 1,135
Only top scored, non community-wiki answers of a minimum length are eligible