update dependencies

backend/build.gradle.kts

@@ -34,9 +34,16 @@ dependencies {
     implementation(libs.flyway.postgres)
     implementation(libs.koin)
     implementation(libs.koin.logger)
+    implementation(libs.random)
     implementation(libs.otp)
     implementation(libs.kdf)
     implementation(libs.hash)
     implementation(libs.encoding)
     implementation(libs.logback)
 }
+
+kotlin {
+    compilerOptions {
+        freeCompilerArgs.add("-opt-in=kotlin.time.ExperimentalTime")
+    }
+}

backend/gradle/libs.versions.toml

@@ -5,9 +5,10 @@ exposed = "0.60.0"
 postgres = "42.7.5"
 flyway = "11.7.0"
 koin = "4.0.3"
-otp = "1.1.0"
-kdf = "1.0.0"
-hash = "1.1.0"
+random = "1.0.0"
+otp = "1.1.1"
+kdf = "1.0.1"
+hash = "1.2.2"
 encoding = "1.1.0"
 logback = "1.5.18"
 
@@ -37,6 +38,7 @@ flyway-postgres = { module = "org.flywaydb:flyway-database-postgresql", version.
 koin = { module = "io.insert-koin:koin-ktor", version.ref = "koin" }
 koin-logger = { module = "io.insert-koin:koin-logger-slf4j", version.ref = "koin" }
 
+random = { module = "com.infendro:random", version.ref = "random" }
 otp = { module = "com.infendro:otp", version.ref = "otp" }
 kdf = { module = "com.infendro:kdf", version.ref = "kdf" }
 hash = { module = "com.infendro:hash", version.ref = "hash" }

backend/src/main/kotlin/com/infendro/account/util/OTP.kt

@@ -6,9 +6,7 @@ import com.infendro.otp.SecretGenerator
 import com.infendro.otp.TOTP
 import kotlin.time.Clock
 import kotlin.time.Duration.Companion.seconds
-import kotlin.time.ExperimentalTime
 
-@OptIn(ExperimentalTime::class)
 object OTP {
     private val totp = TOTP(
         function = SHA256,

backend/src/main/kotlin/com/infendro/account/util/SecureHasher.kt

@@ -3,11 +3,11 @@ package com.infendro.account.util
 import com.infendro.encoding.Hex
 import com.infendro.hash.SHA256
 import com.infendro.kdf.PBKDF2
-import kotlin.random.Random
+import com.infendro.random.PRNG
 
 object SecureHasher {
     private val kdf = PBKDF2(SHA256)
-    private val random = Random.Default
+    private val random = PRNG.HMAC
 
     fun hash(
         value: String,

backend/src/main/kotlin/com/infendro/account/util/TokenGenerator.kt

@@ -1,11 +1,10 @@
 package com.infendro.account.util
 
 import com.infendro.encoding.Hex
-import kotlin.random.Random
+import com.infendro.random.PRNG
 
-// TODO implement secure random
 object TokenGenerator {
-    private val random = Random.Default
+    private val random = PRNG.HMAC
 
     fun generate(): String {
         val bytes = ByteArray(32)