sjlombardo/sqlcipher — Issue #15: Use RAND_bytes() for IVs, not RAND_pseudo_bytes()
Author: nmathewson
Created: 2011-11-30 17:54:12+00:00
State: open

CBC mode relies for many of its security properties on having IVs that the attacker cannot predict. But according to OpenSSL's documentation, RAND_pseudo_bytes() shouldn't be used in cases where the output needs to be unpredictable.

>RAND_pseudo_bytes() puts num pseudo-random bytes into buf. Pseudo-
>random byte sequences generated by RAND_pseudo_bytes() will be unique
>if they are of sufficient length, but are not necessarily
>unpredictable. They can be used for non-cryptographic purposes and for
>certain purposes in cryptographic protocols, but usually not for key
>generation etc.

Fortunately, this isn't currently a security hole for most OpenSSL users: The default RAND_pseudo_bytes implementation is ssleay_rand_pseudo_bytes, which just calls RAND_bytes. But if somebody's overridden the default RNG with some engine, they might wind up with bad IVs here. Also, if some future version of OpenSSL provides a faster (but more predictable) RAND_pseudo_bytes implementation, sqlcipher's security would be affected.