SmartTube
SmartTube copied to clipboard
Changing Random to SecureRandom, and stop deriving key from hash
Hi, I am new to SmartTube, and when I was browsing the code I found some potential risks.
-
Random is used In the file
CachedContentIndex.javatheRandomis define here, and later it's used to generate the IV here. It's not secure enough, and should switch toSecreRandomfor better security. -
Derive key from hash In the file
AesCipherDataSource.javathe nonce is generated from hash here. It cannot provide enough randomness and can be predictable. Generating the nonce bySecureRandomcan be better.