TCPDF icon indicating copy to clipboard operation
TCPDF copied to clipboard

Improve quality of generated seed, avoid potential security pitfall

Open xelan opened this issue 5 months ago • 0 comments

  • Try to use random_bytes() first if it's available
  • Do not include the server parameters in the generated seed, as they might contain sensitive data

As all current usages of getRandomSeed() directly hash the seed, there should be no BC breaking changes.

The main source of entropy is more than enough on its own if random_bytes() or openssl_random_pseudo_bytes() are available.

xelan avatar Sep 17 '24 14:09 xelan