Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-80149

Insecure random generation in cryptographic code

    XMLWordPrintable

Details

    • Bug
    • Resolution: Invalid
    • Not Evaluated
    • None
    • 5.13.1
    • Network: Sockets
    • None
    • All

    Description

      qtbase/src/network/ssl/qsslsocket_qt.cpp contains the code:

      static QByteArray _q_PKCS12_salt()
      {
          QByteArray salt;
          salt.resize(8);
          for (int i = 0; i < salt.size(); ++i)
              salt[i] = (qrand() & 0xff);
          return salt;
      }
      

      The problem is that qrand is a simple wrapper around rand and does not generate cryptographically secure random numbers.  I believe this should be replaced with:

      static QByteArray _q_PKCS12_salt()
      {
          // Note that QRandomGenerator::system() is usually cryptographically safe.
          const quint64 salt = QRandomGenerator::system()->generate64();
          return QByteArray{reinterpret_cast<const char*>(&salt), sizeof(salt)};
      }
      

       

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            tpochep Timur Pocheptsov
            martinbonner Martin Bonner
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes