Quick and probably nasty kludge to introduce increased entropy method…

main.go

@@ -79,7 +79,6 @@ func main() {
 
  loginError = WebAuthnError{Message: "Unable to login"}
  registrationError = WebAuthnError{Message: "Error during registration"}
- util.RandInit()
 
  users = make(map[string]u.User)
  registrations = make(map[string]u.User)
@@ -179,7 +178,7 @@ func main() {
  }
  webAuthns[rpOrigin] = webAuthn
 
- var sessionStoreKey = util.RandStringBytesRmndr(32)
+ var sessionStoreKey = []byte(util.GenChallenge())
  var sessionStore = sessions.NewCookieStore(sessionStoreKey)
  // Sessions maintained for up to soft timeout limit
  sessionStore.Options = &sessions.Options{
@@ -611,7 +610,7 @@ func checkOrigin(r *http.Request) (*webauthn.WebAuthn, *sessions.CookieStore, er
  }
  webAuthns[origin] = webAuthn
 
- var sessionStoreKey = util.RandStringBytesRmndr(32)
+ var sessionStoreKey = []byte(util.GenChallenge())
  var sessionStore = sessions.NewCookieStore(sessionStoreKey)
  // Sessions maintained for up to soft timeout limit
  sessionStore.Options = &sessions.Options{

util/util.go

@@ -1,19 +1,17 @@
 package util
 
 import (
+ "encoding/base64"
  "encoding/json"
  "errors"
  "fmt"
  "log"
  "net/http"
  "regexp"
 
+ "github.com/duo-labs/webauthn/protocol"
  "github.com/duo-labs/webauthn/webauthn"
  "github.com/gorilla/sessions"
-
- crypto_rand "crypto/rand"
- "encoding/binary"
- math_rand "math/rand"
 )
 
 const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -86,20 +84,12 @@ func SaveWebauthnSession(session *sessions.Session, key string, sessionData *web
  return nil
 }
 
-func RandInit() {
- var b [8]byte
- _, err := crypto_rand.Read(b[:])
+// Generate crytographically secure challenge
+func GenChallenge() string {
+ //call on the import DUO method
+ challenge, err := protocol.CreateChallenge()
  if err != nil {
- panic("cannot seed math/rand package with cryptographically secure random number generator")
- }
- math_rand.Seed(int64(binary.LittleEndian.Uint64(b[:])))
-}
-
-// Generate a random string of alpha characters of length n
-func RandStringBytesRmndr(n int) []byte {
- b := make([]byte, n)
- for i := range b {
- b[i] = letterBytes[math_rand.Int63()%int64(len(letterBytes))]
+ panic("Failed to generate cryographically secure challenge")
  }
- return b
+ return base64.RawURLEncoding.EncodeToString(challenge)
 }