jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-25 11:56:11 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Use a CSPRNG for salts, tokens, and RNG seeding

Browse source 
Password salts and activation tokens were generated with the global SFMT
RNG, which was seeded from a 32-bit timestamp, making registration
salts and activation tokens predictable. The game RNG used the same
timestamp seed across restarts.

Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token
generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the
client and server. Link libcockatrice_utility against OpenSSL::Crypto.

Took 30 seconds

Took 25 minutes
This commit is contained in:
Lukas Brübach 2026-08-04 10:02:35 +02:00 • committed by GitHub
parent 704611fc1f
commit a01dca4f6c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 101 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

3
cockatrice/src/main.cpp
View file

@ -53,6 +53,7 @@
#include <libcockatrice/settings/interface_settings.h>
#include <libcockatrice/settings/network_settings.h>
#include <libcockatrice/settings/personal_settings.h>
#include <libcockatrice/utility/cryptoutil.h>
QTranslator *translator, *qtTranslator;
RNG_Abstract *rng;
@ -292,7 +293,7 @@ int main(int argc, char *argv[])
}
}
rng = new RNG_SFMT;
rng = new RNG_SFMT(CryptoUtil::randomUInt64());
themeManager = new ThemeManager;
soundEngine = new SoundEngine;