Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use /dev/random to create a key #22

Merged
merged 1 commit into from
Apr 19, 2022
Merged

Use /dev/random to create a key #22

merged 1 commit into from
Apr 19, 2022

Conversation

sunwire
Copy link
Contributor

@sunwire sunwire commented Jul 26, 2020

Use /dev/random file to create a new key instead of rand() function. It provides much more cryptographically secure random output.

@JoelStienlet
Copy link

Thanks A LOT for seeing this blunder! The way it was coded was not secure at all, everybody should consider their tape entirely unencrypted.
How you can crack "encrypted" tapes:
rand() is a deterministic function. The only random part of the previous code was to read a random input from getchar().
But: getchar() will only take ~200 different values. So, summing (with the usual "+", the operation is not crypto at all !) lets say 20 characters, each taking a number between 0 and 200, you end up with a srand() seed between 0 and 4000. That's it, by simply testing ~4000 combinations you can crack the "encryption".

@marianrh
Copy link

Since this hasn't been merged in a few months now, I'd just like to leave my method of creating a random key here for other people stumbling over this issue:
xxd -l 32 -c 32 -p /dev/random

@ninthclowd
Copy link
Collaborator

Unfortunately I have no way to test this atm. Would someone else validate and do the pull request?

Copy link
Contributor

@fpiecka fpiecka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change seems pretty good to me.

I've successfuly built the program and I've tested it on Linux both with and without /dev/random being available.

@jonasstein jonasstein merged commit e1e3676 into scsitape:master Apr 19, 2022
@sunwire sunwire mentioned this pull request Apr 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants