Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Security by Using Cryptographically Secure Random Numbers for IV Generation #191

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

kexinoh
Copy link

@kexinoh kexinoh commented Aug 4, 2024

this pull request aims to enhance the security of the encryption process by replacing the non-cryptographically secure random number generation in the get_initialization_vector method with a cryptographically secure alternative.

While maintaining backward compatibility, the changes made in this PR focus on the following:

The use of random.randint for generating the initialization vector (IV) has been replaced with os.urandom to ensure that the IV is generated using a cryptographically secure random number generator.
The default static IV is retained to ensure backward compatibility with existing systems that may rely on this behavior. However, it is strongly recommended to use the new, cryptographically secure random IV generation for all new encryption operations.

These changes will help protect against potential vulnerabilities associated with predictable IVs without breaking existing functionality.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant