From d28575c63fac6f97c6fcb343904868a1c92735f7 Mon Sep 17 00:00:00 2001 From: Michael Cheers Date: Tue, 25 Nov 2025 15:35:03 -0200 Subject: [PATCH] fix: use cryptographically secure RNG for IV generation --- .../iTextSharp/text/pdf/crypto/IVGenerator.cs | 26 +++++-------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/src/iTextSharp.LGPLv2.Core/iTextSharp/text/pdf/crypto/IVGenerator.cs b/src/iTextSharp.LGPLv2.Core/iTextSharp/text/pdf/crypto/IVGenerator.cs index 63795f2d..f5f2c6ec 100644 --- a/src/iTextSharp.LGPLv2.Core/iTextSharp/text/pdf/crypto/IVGenerator.cs +++ b/src/iTextSharp.LGPLv2.Core/iTextSharp/text/pdf/crypto/IVGenerator.cs @@ -1,27 +1,14 @@ +using System.Security.Cryptography; + namespace iTextSharp.text.pdf.crypto; /// -/// An initialization vector generator for a CBC block encryption. It's a random generator based on RC4. +/// An initialization vector generator for a CBC block encryption. +/// Uses cryptographically secure random number generation. /// @author Paulo Soares (psoares@consiste.pt) /// public static class IvGenerator { - private static readonly ArcfourEncryption _rc4; - - static IvGenerator() - { - _rc4 = new ArcfourEncryption(); - var longBytes = new byte[8]; - var val = DateTime.Now.Ticks; - for (var i = 0; i != 8; i++) - { - longBytes[i] = (byte)val; - val = (long)((ulong)val >> 8); - } - - _rc4.PrepareArcfourKey(longBytes); - } - /// /// Gets a 16 byte random initialization vector. /// @@ -36,11 +23,10 @@ static IvGenerator() public static byte[] GetIv(int len) { var b = new byte[len]; - lock (_rc4) + using (var rng = RandomNumberGenerator.Create()) { - _rc4.EncryptArcfour(b); + rng.GetBytes(b); } - return b; } } \ No newline at end of file