Using sources of randomness in WASM

[piotr-roslaniec]

Hello. I've been working on some snaps that depend on Rust libraries, specifically ones using random number generators. Despite using known techniques I found it challenging to make them work in snaps.

I've come up with a workaround - In short, it relies on manually accessing the source of randomness from inside the snap and passing it into Rust libraries as an RNG seed. You can find a complete description of the problem and a workaround here.

I decided to share this in case there exists a more elegant solution, or in case someone stumbles upon a similar issue.

[tmpfs]

In my experience getrandom works fine, webassmbly should call crypto.getRandomValues() the only problem I encountered is that in a multi-threaded situation crypto.getRandomValues() fails due to the WASM being backed by a SharedArrayBuffer.

In which case I used this workaround:

const getRandomValues = crypto.getRandomValues;
crypto.getRandomValues = function (buffer) {
  const array = new Uint8Array(buffer);
  const value = getRandomValues.call(crypto, array);
  buffer.set(value);
  return buffer;
};

It can be fiddly to get the getrandom dependency configured correctly if your dependency tree has multiple versions of rand, see this doc for more information:

https://github.com/LavaMoat/tss-snap/blob/main/INSTALL.md#getrandom

[piotr-roslaniec]

Hi @tmpfs, thanks for sharing. I've looked into tss-snap and failed to find the place where you access randomness from within the snap. It seems like the snap is only used for persistence. Am I missing something?

[tmpfs]

Hi @tmpfs, thanks for sharing. I've looked into tss-snap and failed to find the place where you access randomness from within the snap. It seems like the snap is only used for persistence. Am I missing something?

Ah sorry @piotr-roslaniec you are right the webassembly there executes in the "dapp" code and not in the snap module.

Maybe somebody from the snaps team can help. Is crypto.getRandomValues() exposed in the snaps module?

[ritave]

@tmpfs It should be. math.random() as well, but we're strongly advising against using it.

[piotr-roslaniec]

Would it be possible to expose window.crypto.getRandomValues() object inside snaps so that we can use a secure source of randomness from the inside?

[ritave]

@piotr-roslaniec It already is exposed to best of my knowledge.