Cockatrice/libcockatrice_rng/libcockatrice/rng
Lukas Brübach a01dca4f6c
[Security] Use a CSPRNG for salts, tokens, and RNG seeding
Password salts and activation tokens were generated with the global SFMT
RNG, which was seeded from a 32-bit timestamp, making registration
salts and activation tokens predictable. The game RNG used the same
timestamp seed across restarts.

Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token
generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the
client and server. Link libcockatrice_utility against OpenSSL::Crypto.

Took 30 seconds

Took 25 minutes
2026-08-29 15:58:56 +02:00
..
sfmt Update external c libs: SFMT & peglib (#6901) 2026-05-22 03:31:59 +02:00
rng_abstract.cpp style: Add braces to all control flow statements (#6887) 2026-05-16 19:19:53 +02:00
rng_abstract.h [Fix-Warnings] Mark const getters as [[nodiscard]] (#6365) 2025-11-28 21:38:54 +01:00
rng_sfmt.cpp [Security] Use a CSPRNG for salts, tokens, and RNG seeding 2026-08-29 15:58:56 +02:00
rng_sfmt.h [Security] Use a CSPRNG for salts, tokens, and RNG seeding 2026-08-29 15:58:56 +02:00