fix: use crypto/rand

internal/util/util.go

@@ -1,36 +1,36 @@
 package util
 
 import (
+	"crypto/rand"
 	"crypto/rsa"
-	"math/rand"
-	"time"
+	"math/big"
 )
 
-var entropy *rand.Rand
-
-func init() {
-	seed := time.Now().UnixNano()
-	source := rand.NewSource(seed)
-	entropy = rand.New(source)
-}
-
 const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
 
 func RandStringBytes(n int) string {
 	b := make([]byte, n)
 	for i := range b {
-		b[i] = letterBytes[rand.Intn(len(letterBytes))]
+		idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(letterBytes))))
+		if err != nil {
+			panic(err)
+		}
+		b[i] = letterBytes[idx.Int64()]
 	}
 	return string(b)
 }
 
 func RandUint64(n uint64) uint64 {
-	return entropy.Uint64() % n
+	val, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
+	if err != nil {
+		panic(err)
+	}
+	return val.Uint64()
 }
 
 func RandomBytes(size int) ([]byte, error) {
 	buf := make([]byte, size)
-	if _, err := entropy.Read(buf); err != nil {
+	if _, err := rand.Read(buf); err != nil {
 		return nil, err
 	}
 	return buf, nil
@@ -39,7 +39,7 @@ func RandomBytes(size int) ([]byte, error) {
 func NewPrivateKey() (*rsa.PrivateKey, string, error) {
 	id := RandStringBytes(22)
 
-	privateKey, err := rsa.GenerateKey(entropy, 2048)
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		return nil, "", err
 	}