React Native:Warning of missing secure random source after installing react-native-get-random-values

[emclab]

My React Native 63.2 app get the following warning about missing a secure random source, after installing react-native-get-random-values

  [Wed Oct 21 2020 11:43:11.514]  BUNDLE  ./index.js

  [Wed Oct 21 2020 11:43:19.165]  LOG      WARNING: This environment is missing a secure random source; generated private keys may be at risk, think VERY carefully about not adding a better secure source.
 [Wed Oct 21 2020 11:43:19.170]  LOG      Shims Injected:
 [Wed Oct 21 2020 11:43:19.172]  LOG        - atob
 [Wed Oct 21 2020 11:43:19.173]  LOG        - btoa
 [Wed Oct 21 2020 11:43:19.175]  LOG        - nextTick
 [Wed Oct 21 2020 11:43:19.177]  LOG        - crypto.getRandomValues
 [Wed Oct 21 2020 11:43:19.178]  LOG        - FileReader.prototype.readAsArrayBuffer

Here is the related package.json:

 "dependencies": {
    "@ethersproject/shims": "^5.0.6",  //<<==ethers shim
   "ethers": "^5.0.17",  //<<==ethers
   "native-base": "^2.13.14",
   "react": "16.13.1",
   "react-native": "0.63.2",
   "react-native-get-random-values": "^1.5.0",  //<<==secure random string source
 },

Here is the import header:

 import React, { Component, useEffect, useState} from 'react';
 import {View, Image, Dimensions, Text, Alert  } from 'react-native';
 import DeviceInfo from 'react-native-device-info';
 import "@ethersproject/shims"  //for ethers.js  //<<==etherjs shim. Tried import shim in App.js and warning is the same.
 // Import the ethers library
 import { ContractFactory, ethers } from "ethers";  //<<==ethers

Does the warning smell trouble? Or just a warning and can be ignored after installing react-native-get-random-values.

[ricmoo]

Hmmm. That seems like your plug-in is not getting registered before the shims are loaded.

Check out #1070

[ricmoo]

Oh. That issue was yours too. :)

Can you try not including the shim, and see if crypto.randomValues exists?

[emclab]

The previous issue is getting too long to read and this issue is more specific about the random module.

After comment out import "@ethersproject/shims", the warning is still there but shorter.

[Wed Oct 21 2020 16:22:33.327]  BUNDLE  ./index.js

[Wed Oct 21 2020 16:22:49.885]  LOG      WARNING: Missing strong random number source

[emclab]

The solution found is that the module react-native-get-random-values has to be imported before the initial importing of ethers shim. (even the module may not be used in the component). Here is the working sequence:

import 'react-native-get-random-values'
import "@ethersproject/shims"  //for ethers.js
import { ContractFactory, ethers } from "ethers";

The warning disappears after importing random module before shim as above.

[ricmoo]

Awesome!! Thanks! :)

[irfanonk]

suddenly I have the same issue in ios emulator but there wasn't any before

import 'react-native-get-random-values'
import "@ethersproject/shims" //for ethers.js
import { ContractFactory, ethers } from "ethers";

I already have above import order but no chance at all. Following is the error thrown. Any suggestion?

[Unhandled promise rejection: Error: no secure random source avaialble (operation="crypto.getRandomValues", code=UNSUPPORTED_OPERATION, version=random/5.5.1)] at http://127.0.0.1:19000/node_modules/expo/AppEntry.bundle?platform=ios&dev=true&hot=false&minify=false:186772:27 in <unknown> at node_modules/@ethersproject/logger/lib/index.js:207:21 in <anonymous> at node_modules/@ethersproject/random/lib/browser-random.js:40:21 in randomBytes at node_modules/@ethersproject/json-wallets/lib/keystore.js:276:9 in encrypt at src/screens/CreateWallet.tsx:56:26 in onRestoreWallet at src/screens/CreateWallet.tsx:56:26 in onRestoreWallet at src/components/Button.tsx:174:13 in useCallback$argument_0 at node_modules/react-native/Libraries/Pressability/Pressability.js:691:17 in _performTransitionSideEffects at node_modules/react-native/Libraries/Pressability/Pressability.js:628:6 in _receiveSignal at node_modules/react-native/Libraries/Pressability/Pressability.js:524:8 in responderEventHandlers.onResponderRelease

[emclab]

I have the problem resurfaced with React Native 0.68.0, React Native get random values 1.7.2 and ethers 5.6.0. I am not sure when the code stopped working and just found out today. Then I upgrade the RN get random values to latest 1.8.0 and ethers to 5.6.5. But the error is the same. Here is the line of code throwing error:

import 'react-native-get-random-values';
import "@ethersproject/shims";  //for ethers.js
import { ContractFactory, ethers } from "ethers";
.....
let a = new ethers.utils.randomBytes(32);  //shall call crypto.getRandomValues() polyfilled by RN get random values.

Here is the error:

Error: no secure random source avaialble (operation="crypto.getRandomValues", code=UNSUPPORTED_OPERATION, version=random/5.6.0)]

[irfanonk]

I have also imported

import 'react-native-get-random-values'
import "@ethersproject/shims"

these two in App.tsx (entry file) have solved the problem for me.

[mantusuff420]

I have also imported

import 'react-native-get-random-values' import "@ethersproject/shims"

these two in App.tsx (entry file) have solved the problem for me.

Thanks man, You just saved my day

[emclab]

Importing both rn get random values and shims in either App.js and index.js didn't work for me.

[emclab]

ethersjs recognize the polyfill of crypto.getRandomBytes but seems viewing it as insecure source of PRNG.

console.log("typeof global.crypto.getrandomvalues : ", typeof(global.crypto.getRandomValues)); //function
console.log("type of ethers.utils.randomBytes : ", typeof(ethers.utils.randomBytes));  //function returned 

[ricmoo]

FYI. The cookbook entry may help.

[HEGADE]

i'm also facing the same issue
"[Error: no secure random source avaialble (operation="crypto.getRandomValues", code=UNSUPPORTED_OPERATION, version=random/5.6.0)]"

[emclab]

global.crypto.getRandomValues() does exist as I verified. In my app, If new ethers.utils.randomBytes(32) throws error, then in catch block global.crypto.getRandomValues() will be used to generate a crypto secure random string.