mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-21 09:05:10 -07:00
fd865c1ea9
Password salts and activation tokens were generated with the global SFMT RNG, which was seeded from a 32-bit timestamp, making registration salts and activation tokens predictable. The game RNG used the same timestamp seed across restarts. Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the client and server. Link libcockatrice_utility against OpenSSL::Crypto. Took 30 seconds Took 25 minutes
25 lines
643 B
C++
25 lines
643 B
C++
#include "cryptoutil.h"
|
|
|
|
#include <openssl/rand.h>
|
|
|
|
namespace CryptoUtil
|
|
{
|
|
QByteArray randomBytes(int count)
|
|
{
|
|
QByteArray bytes(count, '\0');
|
|
if (RAND_bytes(reinterpret_cast<unsigned char *>(bytes.data()), count) != 1) {
|
|
// Randomness failure is fatal: never fall back to a predictable source.
|
|
qFatal("CryptoUtil::randomBytes: RAND_bytes failed");
|
|
}
|
|
return bytes;
|
|
}
|
|
|
|
quint64 randomUInt64()
|
|
{
|
|
quint64 value;
|
|
if (RAND_bytes(reinterpret_cast<unsigned char *>(&value), sizeof(value)) != 1) {
|
|
qFatal("CryptoUtil::randomUInt64: RAND_bytes failed");
|
|
}
|
|
return value;
|
|
}
|
|
} // namespace CryptoUtil
|