haxe-crypto icon indicating copy to clipboard operation
haxe-crypto copied to clipboard

Using PRNG to generate an IV is not a good idea

Open fulopm opened this issue 8 years ago • 1 comments

As far as I can see, the IVMode class (https://github.com/soywiz/haxe-crypto/blob/master/src/com/hurlant/crypto/symmetric/mode/IVMode.hx) uses a PRNG (which is seeded from the system clock) to generate the initialization vector. I recommend you guys to use the SecureRandom class, and manually generate an IV instead of the default mode.

fulopm avatar Aug 11 '16 18:08 fulopm

Please, create a PR for this and I will happily merge it :) I don't have too much time to invest in this, but I I can merge stuff and make releases.

soywiz avatar Aug 22 '16 21:08 soywiz