7

The Bitcoin Project recently announced a bug in the SecureRandom implementation on Android, which caused Bitcoin wallet apps to generate weak private keys that leave bitcoins vulnerable to theft. The major wallet apps have released updates which apparently include their own RNGs instead of using SecureRandom.

However, in principle, weak random numbers could cause vulnerability in any crypto system where they're used. Thus this could affect any app that uses this function for secure communication: perhaps pgp, ssh, remote access and tracking, or even the built in ssl and https implementations.

Is there any information about other affected apps? Has Google announced an OS update to fix the bug, or otherwise responded to the issue?

Improve this question
1
  • I believe that Android's SSL/HTTPS uses OpenSSL which has its own RNG.
    – Peanut
    Aug 15, 2013 at 23:15

1 Answer 1

Reset to default
3

I do not know of any specific apps, but it certainly CAN (on probably does) affect other apps. Read here for Google's notes on the problem, as well as info for developers on how to avoid the bug. They have also issued patches and sent them to their OHA partners, but it is up to each of them to roll out the update.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .