Bug#930662: libauth-googleauth-perl: poor source of entropy for secret generation

[Raphael Geissert]

Package: libauth-googleauth-perl
Version: 1.02-1
Severity: important
Tags: security

Hi,

Auth::GoogleAuth uses the rand function to generate a 16-bytes secret
key for TOTP authentication. Sadly, rand is a poor source of
randomness and unsuitable for crypto-related uses.

Following RFC6238's SHOULDs, Auth::GoogleAuth should use a CSPRNG like
urandom as a source to generate the key, and possibly generate a
20-bytes key to follow a second SHOULD.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org