Skip to content

fix(weaver): usage of weak PRNG issue #1182

fix(weaver): usage of weak PRNG issue

fix(weaver): usage of weak PRNG issue #1182

Re-run triggered December 2, 2023 20:08
Status Failure
Total duration 40s
Artifacts

commitlint-pull-request.yaml

on: pull_request
commitlint
26s
commitlint
Fit to window
Zoom out
Zoom in

Annotations

1 error
commitlint
You have commit messages with errors ⧗ input: fix(weaver): usage of weak PRNG issue The Logic Behind the Problem When RNG (Random Number Generator) values are not received through a hardware TRNG, seed values apply a certain pattern. (It takes a seed value such as a mathematical formula or time.) In response to this situation, there are various secure random classes to increase security. Solution Changes have been made to get random values using safe randomness instead of mathematical randomness. This increases the complexity of the pattern, making it difficult to discover even if data is listened to for long periods of time. The changes that have been made; - In the certificate_utils.go file, the random value was taken from the math class (mrand math/rand) and used. By taking this random value from the secure random class, we obtain a more reliable random value. I added HmacGenerate and generateSecureRandomKey functions for readability and ease of use. If you want to generate a key again, the generateSecureRandomKey function, which uses secure random, can be used. - In HashFunctions.kt, kotlin.random.Random class has been replaced with the more reliable java.security.SecureRandom class. - The reason for the change in eciesCrypto.js is that the length of aes-128-ctr is not considered reliable by various standards. For this reason, I preferred the more reliable 256 length. Fixes #2765 Signed-off-by: Kağan Can Şit <[email protected]> ✖ body's lines must not be longer than 100 characters [body-max-line-length] ✖ found 1 problems, 0 warnings ⓘ Get help: https://github.com/conventional-changelog/commitlint/#what-is-commitlint