Description

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by jsbn@1.1.0, which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T18:18:19.387Z",
  "pubdate": "2026-08-13T18:18:19.387Z",
  "executiveSummary": "The sm-crypto JavaScript library prior to version 0.5.0 suffers from a critical pseudorandom number generation vulnerability residing in its cryptographic key generation routines. Specifically, the default no-argument sm2.generateKeyPairHex() method in Node.js utilizes an insecure entropy source provided by jsbn@1.1.0.\nThe vulnerability allows an attacker to compromise the generation of SM2 private keys and predict signing ephemeral scalars due to predictable seeding mechanisms.\nThe affected product is sm-crypto in versions prior to 0.5.0.\nThe risk implications are severe, enabling complete key recovery and signature forgery.\nAttacker capabilities include observing Math.random() outputs and estimating the key-generation timestamp.\nExploitation requires the ability to observe process-level pseudo-random outputs and approximate the execution time of the key generation operation.",
  "technicalDetails": "The root cause of the vulnerability lies in src/sm2/utils.js where the module-wide SecureRandom instance incorrectly handles cryptographic entropy in Node.js environments.\nEven though globalThis.crypto exists, window.crypto.getRandomValues is treated as unavailable, forcing a fallback mechanism.\nThis fallback implementation seeds an ARC4 stream using Math.random() combined with new Date().getTime().\nBoth Math.random() and timestamps exhibit low entropy and are highly predictable, violating core cryptographic requirements for key generation and ephemeral scalar selection in the SM2 algorithm.\nThe vulnerable component is the key generation utility path invoked via sm2.generateKeyPairHex() without arguments in Node.js.\nAffected versions include all releases of sm-crypto prior to version 0.5.0.\nThe exploitation flow proceeds as follows: First, an attacker observes or infers process-level outputs derived from Math.random(). Second, the attacker estimates the precise timestamp (new Date().getTime()) corresponding to when the target private key or ephemeral signature scalar was generated. Third, using the compromised seed space formed by the predictable random values and time window, the attacker reconstructs the internal state of the ARC4 stream. Finally, the attacker deterministically reproduces the generated SM2 private keys or predicts the signing ephemeral scalars.\nPost-exploitation impact includes the total compromise of confidentiality for encrypted communications, decryption of sensitive data, and the ability to forge valid digital signatures impersonating the victim."
}