Change thread_rng() to OsRng to seed secure randomness

crates/lox-library/src/bridge_table.rs

@@ -143,7 +143,7 @@ impl BridgeLine {
             // Construct a Bucket Reachability credential for this
             // bucket and today's date
             let today_attr: Scalar = today.into();
-            let mut rng = rand::thread_rng();
+            let mut rng = rand::rngs::OsRng;
             let Btable: &RistrettoBasepointTable = &CMZ_B_TABLE;
             let b = Scalar::random(&mut rng);
             let P = &b * Btable;
@@ -202,7 +202,7 @@ impl BridgeLine {
     /// Create a random BridgeLine for testing
     #[cfg(test)]
     pub fn random() -> Self {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let mut res: Self = Default::default();
         // Pick a random 4-byte address
         let mut addr: [u8; 4] = [0; 4];
@@ -321,7 +321,7 @@ impl BridgeTable {
     #[cfg(feature = "bridgeauth")]
     pub fn new_bucket(&mut self, index: u32, bucket: &[BridgeLine; MAX_BRIDGES_PER_BUCKET]) {
         // Pick a random key to encrypt this bucket
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let mut key: [u8; 16] = [0; 16];
         rng.fill_bytes(&mut key);
         self.keys.insert(index, key);
@@ -349,7 +349,7 @@ impl BridgeTable {
     /// are reachable.
     #[cfg(feature = "bridgeauth")]
     pub fn encrypt_table(&mut self, today: u32, reachability_priv: &IssuerPrivKey) {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         self.encbuckets.clear();
         for (uid, key) in self.keys.iter() {
             let bucket = self.buckets.get(uid).unwrap();

crates/lox-library/src/lib.rs

@@ -130,7 +130,7 @@ impl IssuerPrivKey {
     /// Create an IssuerPrivKey for credentials with the given number of
     /// attributes.
     pub fn new(n: u16) -> IssuerPrivKey {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let x0tilde = Scalar::random(&mut rng);
         let mut x: Vec<Scalar> = Vec::with_capacity((n + 1) as usize);
 
@@ -291,7 +291,7 @@ impl BridgeDb {
     /// chosen randomly from the set of open-invitation buckets.
     pub fn invite(&mut self) -> Result<[u8; OPENINV_LENGTH], OpenInvitationError> {
         let mut res: [u8; OPENINV_LENGTH] = [0; OPENINV_LENGTH];
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         // Choose a random invitation id (a Scalar) and serialize it
         let id = Scalar::random(&mut rng);
         res[0..32].copy_from_slice(&id.to_bytes());

crates/lox-library/src/migration_table.rs

@@ -96,7 +96,7 @@ pub fn encrypt_cred(
 ) -> ([u8; 16], [u8; ENC_MIGRATION_BYTES]) {
     let Btable: &RistrettoBasepointTable = &CMZ_B_TABLE;
 
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
 
     // Compute the Migration Key credential MAC Qk
     let Qk = &(migrationkey_priv.x[0]

crates/lox-library/src/proto/blockage_migration.rs

@@ -222,7 +222,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t_lox = Scalar::random(&mut rng);
     let P_lox = t_lox * lox_cred.P;
     let Q_lox = t_lox * lox_cred.Q;
@@ -476,7 +476,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/check_blockage.rs

@@ -154,7 +154,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * lox_cred.P;
     let Q = t * lox_cred.Q;
@@ -317,7 +317,7 @@ impl BridgeAuth {
         // credential.
 
         // Compute the MAC on the visible attributes
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let b = Scalar::random(&mut rng);
         let Pk = &b * Btable;
         let Pktable = RistrettoBasepointTable::create(&Pk);

crates/lox-library/src/proto/issue_invite.rs

@@ -304,7 +304,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * lox_cred.P;
     let Q = t * lox_cred.Q;
@@ -610,7 +610,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/level_up.rs

@@ -377,7 +377,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * lox_cred.P;
     let Q = t * lox_cred.Q;
@@ -860,7 +860,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/migration.rs

@@ -183,7 +183,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t_lox = Scalar::random(&mut rng);
     let P_lox = t_lox * lox_cred.P;
     let Q_lox = t_lox * lox_cred.Q;
@@ -390,7 +390,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/redeem_invite.rs

@@ -214,7 +214,7 @@ pub fn request(
     // Blind showing the Invitation credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * inv_cred.P;
     let Q = t * inv_cred.Q;
@@ -469,7 +469,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/trust_promotion.rs

@@ -201,7 +201,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * lox_cred.P;
     let Q = t * lox_cred.Q;
@@ -518,7 +518,7 @@ impl BridgeAuth {
         // credential.
 
         // Compute the MAC on the visible attributes
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let b = Scalar::random(&mut rng);
         let Pk = &b * Btable;
         let Pktable = RistrettoBasepointTable::create(&Pk);

crates/lox-library/src/proto/update_cred.rs

@@ -196,7 +196,7 @@ pub fn request(
     // Blind showing the Lox credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * lox_cred.P;
     let Q = t * lox_cred.Q;
@@ -464,7 +464,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let id_server = Scalar::random(&mut rng);
         let EncId = (req.EncIdClient.0, req.EncIdClient.1 + &id_server * Btable);
 

crates/lox-library/src/proto/update_invite.rs

@@ -156,7 +156,7 @@ pub fn request(
     // Blind showing the Invitation credential
 
     // Reblind P and Q
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let t = Scalar::random(&mut rng);
     let P = t * inv_cred.P;
     let Q = t * inv_cred.Q;
@@ -379,7 +379,7 @@ impl BridgeAuth {
 
         // Choose a random server id component to add to the client's
         // (blinded) id component
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rngs::OsRng;
         let inv_id_server = Scalar::random(&mut rng);
         let EncInvId = (
             req.EncInvIdClient.0,

crates/lox-library/src/tests.rs

@@ -1178,7 +1178,7 @@ fn test_find_next_available_key() {
 fn block_bridges(th: &mut TestHarness, to_block: usize) {
     let blockable_range = th.ba.bridge_table.buckets.len() - th.ba.bridge_table.spares.len();
     let mut block_index: HashSet<usize> = HashSet::new();
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
 
     while block_index.len() < to_block {
         let rand_num = rng.gen_range(1..blockable_range);
@@ -1371,7 +1371,7 @@ fn test_bridge_replace() {
         // Randomly select a bridge to replace
         let mut num = 100000;
         while !th.ba.bridge_table.buckets.contains_key(&num) {
-            num = rand::thread_rng().gen_range(0..table_size as u32);
+            num = rand::rngs::OsRng.gen_range(0..table_size as u32);
         }
         println!("chosen num is: {:?}", num);
         let replaceable_bucket = *th.ba.bridge_table.buckets.get(&num).unwrap();

crates/lox-library/tests/tests.rs

@@ -20,7 +20,7 @@ fn test_bridgedb() {
 fn test_dup_filter() {
     let mut df1: dup_filter::DupFilter<Scalar> = Default::default();
     let mut df2: dup_filter::DupFilter<Scalar> = Default::default();
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let s1 = Scalar::random(&mut rng);
     let s2 = Scalar::random(&mut rng);
     let s3 = Scalar::random(&mut rng);