Skip to content

Commit 03c6d60

Browse files
committed
Use cryptographically secure random number generator.
Fixes CVE-2022-29245.
1 parent cad9433 commit 03c6d60

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,7 @@ public override void Start(Session session, KeyExchangeInitMessage message)
4646
var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
4747
basepoint[0] = 9;
4848

49-
var rnd = new Random();
50-
_privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
51-
rnd.NextBytes(_privateKey);
49+
_privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
5250

5351
_clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
5452
MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);

0 commit comments

Comments
 (0)