Only 2^64 keys, keys generated using Mersenne Twister & 64-bits of entropy

[HarryR]

OpenFrogget/src/keygen.cpp

Line 16 in 43acb93

rand.seed(time(nullptr) + *reinterpret_cast<unsigned long*>(openssl_seed));

You're seeding GMP's Mersenne Twister RNG...

With 64 bits...

You should change the function name from generate_secure_private_key to generate_weak_entropy.

In other words, you're discarding 28 bytes of good entropy, to seed a PRNG which can be trivially inverted, to generate 512bits of bad entropy, which is then used as key material!

[victormeloasm]

Security Improvement: Replaced Weak PRNG-Based Key Generation with Strong Cryptographic RNG

Problem:

The original implementation of the generate_secure_private_key() function used OpenSSL’s RAND_bytes() to retrieve 32 bytes of high-entropy randomness, but only utilized the first 64 bits of that entropy to seed GMP’s Mersenne Twister (gmp_randstate_t) engine. This resulted in the following issues:

• The remaining 28 bytes of secure entropy were discarded.
• GMP's Mersenne Twister is a fast but non-cryptographically secure PRNG.
• The generated private keys were derived from a low-entropy seed and were trivially predictable under certain attack models.

Original vulnerable code snippet:

unsigned char openssl_seed[32];
RAND_bytes(openssl_seed, sizeof(openssl_seed));
gmp_randstate_t rand;
gmp_randinit_mt(rand);
rand.seed(time(nullptr) + *reinterpret_cast<unsigned long*>(openssl_seed));

Why this was insecure:

Using only 64 bits of entropy to seed a PRNG that is not designed for cryptographic purposes introduces severe weaknesses in key generation. The entropy pool is drastically reduced, and the resulting private keys are not truly random nor secure.

---

Solution:

The updated implementation eliminates the use of GMP’s PRNG entirely. Instead, it securely generates a full 512-bit random integer using OpenSSL’s RAND_bytes() and imports it directly into a GMP mpz_t, ensuring that:

• All 64 bytes (512 bits) of entropy are used.
• The key lies in the correct range: (0, 2^512).
• No intermediate weak PRNGs are used in the generation process.

New secure code snippet:

unsigned char buffer[64];
if (RAND_bytes(buffer, sizeof(buffer)) != 1) {
    throw std::runtime_error("Failed to generate secure random bytes.");
}

mpz_t max_value;
mpz_init(max_value);
mpz_ui_pow_ui(max_value, 2, 512);

mpz_init(private_key);
do {
    mpz_import(private_key, sizeof(buffer), 1, 1, 0, 0, buffer);
} while (mpz_cmp_ui(private_key, 0) == 0 || mpz_cmp(private_key, max_value) >= 0);

mpz_clear(max_value);

---

Impact:

This change significantly improves the security of ECC key generation by relying exclusively on a cryptographically secure random number generator and eliminating unsafe entropy reduction practices.