Commit graph

8 commits

Author SHA1 Message Date
Patrik Nordwall
b75bb8fc46 Deprecation and documentation for the AESCounterBuiltinRNG issue
* reproducer test of AESCounterBuiltinRNG issue
* update documentation of random-number-generator
* deprecate AES128CounterSecureRNG AES256CounterSecureRNG
* incorporate feedback from Johannes
2018-08-29 18:25:37 +02:00
Rafał Sumisławski
56498e7e58 Fix vulnerability in AESCounterBuiltinRNG
* The problem is that that internal counter isn’t incremented before cipher.doFinal() is used
* AES/CTR has a counter internally and cipher.update() should be used
* Another issue is that AES128CounterSecureRNG is initially seeded with a 16 bytes seed/key, but once it
  hits ReseedingThreshold it reseeds itself with a 32 bytes seed, effectively becoming AES256. This will
  crash if strong encryption is disabled.
2018-08-29 18:24:43 +02:00
Konrad `ktoso` Malawski
563c7fbcf0 Issue 24594: Integration with sbt-headers and initial header population 2018-03-13 15:45:55 +01:00
Christopher Batey
009214ae07
Update copyright to 2018 (#24241) 2018-01-04 17:26:29 +00:00
Dale Wijnand
6693fd6f7d Drop the exec bit on non-executable files 2017-05-23 16:06:27 +02:00
Philippus Baalman
ef9c7313b6 Extend copyright into 2017 (#22833) 2017-05-04 15:14:33 +02:00
gosubpl
c80c3e16c4 remove org.uncommons.maths dependency (#12636)
Also
* add InternalApi annotation to AESCounterBuiltinRNG
* add setDaemon(true) to re-seeder thread
2017-01-13 10:23:06 +01:00
gosubpl
1f20c86d99 AES-CTR with re-seeding, review remarks included (#21740) 2017-01-11 04:31:09 +01:00