Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign uparc4random not cryptographically secure #36
Comments
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment
Hide comment
lvh
commented
Aug 7, 2015
|
This should emphatically be |
brianker
self-assigned this
Aug 18, 2015
added a commit
that referenced
this issue
Aug 20, 2015
winobjc-bot
added
the
Approved
label
Nov 3, 2015
keluo-ms
closed this
Nov 5, 2015
winobjc-bot
added
the
Approved
label
Nov 5, 2015
rajsesh
unassigned
brianker
Jun 30, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
MikeWeller commentedAug 7, 2015
•
edited by rajsesh
Edited 1 time
-
rajsesh
edited Jun 30, 2016 (most recent)
People rely on arc4random being a cryptographically secure source of random numbers.
The implementation in CFMisc.mm is just calling rand() a few times which is pretty terrible.
It should instead use a real cryptographic PRNG algorithm and be seeded from some kind of reliable source of random data. Either implement it properly or at least call an equivalent windows API for some secure random numbers.