The mathematical principle in the Ruby code is OK: it aims at generating a private key in range $[1\dots\mathtt{$group.order}-1]$, then the corresponding public key, for the Elliptic Curve secp256k1 (used e.g. by Bitcoin's ECDSA signatures). This is believed to give near 128-bit security, good for a decade.
How secure that really is depends primarily on the integrity of the computer where the code is run, on how carefully the private key is used, and on the quality of SecureRandom.random_number
.
The problem discussed in the linked question discuss DSA (not ECDSA) being deprecated in some contexts, because
- In many Linux distributions, DSA private keys used to be generated by a broken random number generator, making many of them easy to guess. Getting rid of DSA is a simple, sure, and acceptably annoying way to fix vulnerability to this issue.
- DSA often was used with 1024-bit base group, and that does not give adequate security margin by today's standards (although public attacks are far below that threshold).
The closest thing to a commonality between that and the question's code is that if SecureRandom.random_number
was not secure, what's done would be unsafe.