SmartTube icon indicating copy to clipboard operation
SmartTube copied to clipboard

Changing Random to SecureRandom, and stop deriving key from hash

Open Gax-c opened this issue 1 year ago • 0 comments

Hi, I am new to SmartTube, and when I was browsing the code I found some potential risks.

  1. Random is used In the file CachedContentIndex.java the Random is define here, and later it's used to generate the IV here. It's not secure enough, and should switch to SecreRandom for better security.

  2. Derive key from hash In the file AesCipherDataSource.java the nonce is generated from hash here. It cannot provide enough randomness and can be predictable. Generating the nonce by SecureRandom can be better.

Gax-c avatar May 14 '24 07:05 Gax-c