jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-23 18:06:26 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Use a CSPRNG for salts, tokens, and RNG seeding

Browse source 
Password salts and activation tokens were generated with the global SFMT
RNG, which was seeded from a 32-bit timestamp, making registration
salts and activation tokens predictable. The game RNG used the same
timestamp seed across restarts.

Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token
generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the
client and server. Link libcockatrice_utility against OpenSSL::Crypto.

Took 30 seconds

Took 25 minutes
This commit is contained in:
Lukas Brübach 2026-08-04 10:02:35 +02:00 • committed by GitHub
parent 704611fc1f
commit a01dca4f6c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 101 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

3
servatrice/src/main.cpp
View file

@ -33,6 +33,7 @@
#include <QtGlobal>
#include <iostream>
#include <libcockatrice/rng/rng_sfmt.h>
#include <libcockatrice/utility/cryptoutil.h>
#include <libcockatrice/utility/passwordhasher.h>
RNG_Abstract *rng;
@ -169,7 +170,7 @@ int main(int argc, char *argv[])
signalhandler = new SignalHandler();
rng = new RNG_SFMT;
rng = new RNG_SFMT(CryptoUtil::randomUInt64());
std::cerr << "Servatrice " << VERSION_STRING << " starting." << std::endl;
std::cerr << "-------------------------" << std::endl;