Przeglądaj źródła

Use cryptographically secure random number generator.
Fixes CVE-2022-29245.

drieseng 3 lat temu
rodzic
commit
03c6d60736

+ 1 - 3
src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

@@ -46,9 +46,7 @@ namespace Renci.SshNet.Security
             var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             basepoint[0] = 9;
 
-            var rnd = new Random();
-            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
-            rnd.NextBytes(_privateKey);
+            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
 
             _clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);