archetech / archon / 30916659868

94%

main: 87%

Pull #857

github

test(cipher): guard against a silent weak-RNG substitution

SECURITY.md calls the throw-rather-than-fall-back property "the property most
worth preserving", but nothing asserted it. The July 2026 Coldcard incident is
the worked example of why that matters: a build-configuration error bound seed
generation to a deterministic fallback PRNG instead of the hardware RNG,
cutting real entropy to roughly 40 bits, and it went unnoticed for five years
because degraded output still looks random.

Four tests, covering both directions:

- mnemonic and vault-key generation each draw from crypto.getRandomValues
- each path throws, rather than returning anything, when no CSPRNG exists

Writing this surfaced something the doc did not capture: there are TWO
independent RNG implementations in play. Mnemonics and salts go through
@noble/hashes randomBytes; vault keypairs go through @noble/secp256k1, which
ships its own. Separate packages on separate version lines, so a bump can
change one and not the other. Each now has its own test.

Verified non-vacuous rather than assumed: with a Coldcard-style deterministic
PRNG patched over the RNG in @noble/hashes (three copies, including the one
nested under @noble/curves) and in @noble/secp256k1, all four tests fail. They
pass again once the dependencies are restored. An earlier draft using
jest.resetModules() alone passed vacuously — the ESM module cache kept the
original crypto capture, so the throw path was never reached.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

3609 of 4063 branches covered (88.83%)

Branch coverage included in aggregate %.

8230 of 8512 relevant lines covered (96.69%)

687.14 hits per line