reverting back to mathrand

Author: aswanidutt

child/child.go

@@ -4,12 +4,11 @@
 package child
 
 import (
-	cryptorand "crypto/rand"
 	"errors"
 	"fmt"
 	"io"
 	"log"
-	"math/big"
+	"math/rand"
 	"os"
 	"os/exec"
 	"strings"
@@ -476,15 +475,7 @@ func (c *Child) randomSplay() <-chan time.Time {
 	}
 
 	ns := c.splay.Nanoseconds()
-	// Use crypto/rand for secure random generation (CWE-338 fix)
-	max := big.NewInt(ns)
-	n, err := cryptorand.Int(cryptorand.Reader, max)
-	if err != nil {
-		// Fallback to no splay if crypto/rand fails
-		log.Printf("[WARN] (child) failed to generate secure random splay: %v", err)
-		return time.After(0)
-	}
-	t := time.Duration(n.Int64())
+	t := time.Duration(rand.Int63n(ns))
 
 	c.logger.Printf("[DEBUG] (child) waiting %.2fs for random splay", t.Seconds())
 

dependency/vault_common.go

@@ -4,11 +4,10 @@
 package dependency
 
 import (
-	cryptorand "crypto/rand"
 	"encoding/json"
 	"fmt"
 	"log"
-	"math/big"
+	"math/rand"
 	"sync"
 	"time"
 
@@ -186,15 +185,15 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 		sleep = sleep / 3.0
 
 		// Use some randomness so many clients do not hit Vault simultaneously.
-		sleep = sleep * (secureRandomFloat64() + 1) / 2.0
+		sleep = sleep * (rand.Float64() + 1) / 2.0
 	} else if !rotatingSecret {
 		// If the secret doesn't have a rotation period, this is a non-renewable leased
 		// secret.
 		// For non-renewable leases set the renew duration to use much of the secret
 		// lease as possible. Use a stagger over the configured threshold
 		// fraction of the lease duration so that many clients do not hit
 		// Vault simultaneously.
-		finalFraction := VaultLeaseRenewalThreshold + (secureRandomFloat64()-0.5)*0.1
+		finalFraction := VaultLeaseRenewalThreshold + (rand.Float64()-0.5)*0.1
 		if finalFraction >= 1.0 || finalFraction <= 0.0 {
 			// If the fraction randomly winds up outside of (0.0-1.0), clamp
 			// back down to the VaultLeaseRenewalThreshold provided by the user,
@@ -209,25 +208,10 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 	return time.Duration(sleep)
 }
 
-// secureRandomFloat64 generates a cryptographically secure random float64 in [0.0, 1.0).
-// This is thread-safe and used to fix CWE-338.
-func secureRandomFloat64() float64 {
-	max := big.NewInt(1000000)
-	n, err := cryptorand.Int(cryptorand.Reader, max)
-	if err != nil {
-		// Fallback to 0.5 if crypto/rand fails (rare but possible)
-		log.Printf("[WARN] Failed to generate secure random number: %v", err)
-		return 0.5
-	}
-	return float64(n.Int64()) / 1000000.0
-}
-
 // jitter adds randomness to a duration to prevent thundering herd.
-// It reduces the duration by up to maxJitter (10%) randomly using crypto/rand.
-// This function is thread-safe.
+// It reduces the duration by up to maxJitter (10%) randomly.
 func jitter(t time.Duration) time.Duration {
-	randomFloat := secureRandomFloat64()
-	f := float64(t) * (1.0 - maxJitter*randomFloat)
+	f := float64(t) * (1.0 - maxJitter*rand.Float64())
 	return time.Duration(f)
 }
 

watch/view.go

@@ -4,11 +4,10 @@
 package watch
 
 import (
-	cryptorand "crypto/rand"
 	"errors"
 	"fmt"
 	"log"
-	"math/big"
+	"math/rand"
 	"reflect"
 	"sync"
 	"time"
@@ -312,15 +311,7 @@ const minDelayBetweenUpdates = time.Millisecond * 100
 func rateLimiter(start time.Time) time.Duration {
 	remaining := minDelayBetweenUpdates - time.Since(start)
 	if remaining > 0 {
-		// Use crypto/rand for secure random generation (CWE-338 fix)
-		max := big.NewInt(20000000) // 0-20ms in nanoseconds
-		n, err := cryptorand.Int(cryptorand.Reader, max)
-		if err != nil {
-			// Fallback to no dither if crypto/rand fails
-			log.Printf("[WARN] (view) failed to generate secure random dither: %v", err)
-			return remaining
-		}
-		dither := time.Duration(n.Int64())
+		dither := time.Duration(rand.Int63n(20000000)) // 0-20ms in nanoseconds
 		return remaining + dither
 	}
 	return 0