Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-80149

Insecure random generation in cryptographic code

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Not Evaluated
    • Resolution: Invalid
    • Affects Version/s: 5.13.1
    • Fix Version/s: None
    • Component/s: Network: Sockets
    • Labels:
      None
    • Platform/s:
      All

      Description

      qtbase/src/network/ssl/qsslsocket_qt.cpp contains the code:

      static QByteArray _q_PKCS12_salt()
      {
          QByteArray salt;
          salt.resize(8);
          for (int i = 0; i < salt.size(); ++i)
              salt[i] = (qrand() & 0xff);
          return salt;
      }
      

      The problem is that qrand is a simple wrapper around rand and does not generate cryptographically secure random numbers.  I believe this should be replaced with:

      static QByteArray _q_PKCS12_salt()
      {
          // Note that QRandomGenerator::system() is usually cryptographically safe.
          const quint64 salt = QRandomGenerator::system()->generate64();
          return QByteArray{reinterpret_cast<const char*>(&salt), sizeof(salt)};
      }
      

       

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            Assignee:
            tpochep Timur Pocheptsov
            Reporter:
            martinbonner Martin Bonner
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Gerrit Reviews

                There are no open Gerrit changes