Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-80149

Insecure random generation in cryptographic code

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Not Evaluated
    • Resolution: Invalid
    • Affects Version/s: 5.13.1
    • Fix Version/s: None
    • Component/s: Network: Sockets
    • Labels:
      None
    • Platform/s:
      All

      Description

      qtbase/src/network/ssl/qsslsocket_qt.cpp contains the code:

      static QByteArray _q_PKCS12_salt()
      {
          QByteArray salt;
          salt.resize(8);
          for (int i = 0; i < salt.size(); ++i)
              salt[i] = (qrand() & 0xff);
          return salt;
      }
      

      The problem is that qrand is a simple wrapper around rand and does not generate cryptographically secure random numbers.  I believe this should be replaced with:

      static QByteArray _q_PKCS12_salt()
      {
          // Note that QRandomGenerator::system() is usually cryptographically safe.
          const quint64 salt = QRandomGenerator::system()->generate64();
          return QByteArray{reinterpret_cast<const char*>(&salt), sizeof(salt)};
      }
      

       

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            • Assignee:
              tpochep Timur Pocheptsov
              Reporter:
              martinbonner Martin Bonner
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Gerrit Reviews

                There are no open Gerrit changes