[email protected] uses jsbn's SecureRandom for SM2 key generation. In browsers, SecureRandom seeds an ARC4 stream from window.crypto.getRandomValues, providing cryptographically secure randomness. However, in Node.js, window is undefined, so the secure seeding branch is skipped. Instead, the RNG pool is seeded from Math.random (a recoverable xorshift128+ PRNG) and Date.getTime(), both of which are non-cryptographic and attacker-estimable. Consequently, SM2 private keys and signing ephemeral scalars generated by the default no-argument call path are predictable. A proof-of-concept demonstrates that pinning Math.random and the clock before loading sm-crypto results in deterministic key generation, confirming the vulnerability. This issue affects sm-crypto versions before 0.5.0 and is not mitigated by any existing fixes or configuration options.

An attacker who can observe some outputs of Math.random and estimate the approximate time of key generation can predict SM2 private keys and signing ephemeral scalars generated by sm-crypto in Node.js. This compromises the confidentiality and integrity of cryptographic operations relying on these keys, enabling key recovery and signature forgery. The vulnerability affects all users of the default key generation path in sm-crypto versions prior to 0.5.0 running in Node.js environments.

No official fix or patch is currently available for this vulnerability in [email protected]. Users should avoid using the default key generation in Node.js environments until a patched version is released. Monitor the vendor or repository for updates addressing this issue. Since the vulnerability arises from the fallback to non-cryptographic RNG sources, a potential mitigation is to patch or override the RNG initialization to use Node.js's globalThis.crypto.getRandomValues or another cryptographically secure RNG before loading sm-crypto, but this requires custom intervention. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.