Use SecureRandom rather than OpenSSL::Random

SecureRandom uses OpenSSL::Random under the hood anyway but is apparently a more secure: https://bugs.ruby-lang.org/issues/4579
mdp · Apr 21, 2016 · daaaa11 · daaaa11
1 parent c73784e
commit daaaa11
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/rotp.rb b/lib/rotp.rb
@@ -1,6 +1,6 @@
 require 'cgi'
 require 'uri'
-require 'openssl'
+require 'securerandom'
 require 'rotp/base32'
 require 'rotp/otp'
 require 'rotp/hotp'

diff --git a/lib/rotp/base32.rb b/lib/rotp/base32.rb
@@ -15,7 +15,7 @@ def decode(str)
 
       def random_base32(length=16)
         b32 = String.new
-        OpenSSL::Random.random_bytes(length).each_byte do |b|
+        SecureRandom.random_bytes(length).each_byte do |b|
           b32 << CHARS[b % 32]
         end
         b32