hbs / pyssss Goto Github PK

⚠️ random.randint() is used to generate pseudo numbers for non security sensitive applications, random() is being used in this program and it is a security risk.

"Warning The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator." https://docs.python.org/2/library/random.html

The pickRandomPolynomial function ensures that the generated polynomial has a non-zero top coefficient. This isn't necessary, and actually causes a small information leak. If an attacker with k-1 keys runs them through the decode (and knows the value of k), he can say for certain that none of the bytes of the resulting secret are correct. Ideally, about 1/256 of them should be correct (but the attacker of course won't know which), which is what you get if you allow the top coefficient to be zero.

Could you allow the customization of other suitable modulo polynomials except x^8+x^4+x^3+x+1 ? Because that will create a wider variety of "Cipher text" or "Salt" so it will be harder to crack.

I can't get this to work for k = 2. (Where you want 2 of n to reveal the secret.)

Here's a testcase:

Edit the test at the bottom of PySSSS.py to set k=2 instead of k=3.
Now run "python PySSSS.py".
Result: it spits out garbledegook.

Now edit it back to say k=3, and it works.