Currently react-native-uuid is used to create random strings for the salt in the pin derivation function. This function is pseudorandom and should not be used for security functions.
This should be replaced with Crypto.randomUUID() from Expo Crypto which is already included in the project - https://docs.expo.dev/versions/latest/sdk/crypto
There are also some other packages that need to be looked at which are included in package.json but don't appear to be used. These provide similar functions and should be removed if not needed or updated to expo crypto if required.
- react-native-get-random-values
- "uuid": "~9.0.1" appears to be part of Zustand
Note that react-native-quick-crypto is also included in package.json. Quick crypto is a polyfill that provides node crypto functions including random functions. It is included only to support injecting PBKDF as a hashing function for the key derivation function and should not be used as a general polyfill - see comments in the sample code.
Currently react-native-uuid is used to create random strings for the salt in the pin derivation function. This function is pseudorandom and should not be used for security functions.
This should be replaced with Crypto.randomUUID() from Expo Crypto which is already included in the project - https://docs.expo.dev/versions/latest/sdk/crypto
There are also some other packages that need to be looked at which are included in package.json but don't appear to be used. These provide similar functions and should be removed if not needed or updated to expo crypto if required.
Note that react-native-quick-crypto is also included in package.json. Quick crypto is a polyfill that provides node crypto functions including random functions. It is included only to support injecting PBKDF as a hashing function for the key derivation function and should not be used as a general polyfill - see comments in the sample code.