monero/contrib/epee/include
anonimal cd57a10c90
epee: abstract_tcp_server2: resolve CID 203919 (DC.WEAK_CRYPTO)
The problem actually exists in two parts:

1. When sending chunks over a connection, if the queue size is
greater than N, the seed is predictable across every monero node.

>"If rand() is used before any calls to srand(), rand() behaves as if
it was seeded with srand(1). Each time rand() is seeded with the same seed, it
must produce the same sequence of values."

2. The CID speaks for itself: "'rand' should not be used for security-related
applications, because linear congruential algorithms are too easy to break."

*But* this is an area of contention.

One could argue that a CSPRNG is warranted in order to fully mitigate any
potential timing attacks based on crafting chunk responses. Others could argue
that the existing LCG, or even an MTG, would suffice (if properly seeded). As a
compromise, I've used an MTG with a full bit space. This should give a healthy
balance of security and speed without relying on the existing crypto library
(which I'm told might break on some systems since epee is not (shouldn't be)
dependent upon the existing crypto library).
2019-09-08 01:14:39 +00:00
..
net epee: abstract_tcp_server2: resolve CID 203919 (DC.WEAK_CRYPTO) 2019-09-08 01:14:39 +00:00
serialization serialization: set default log category 2019-04-21 09:26:25 +00:00
storages epee: support unicode in parsed strings 2019-08-16 17:06:03 +00:00
ado_db_helper.h
byte_slice.h Add ref-counted buffer byte_slice. Currently used for sending TCP data. 2019-07-16 16:30:35 +00:00
console_handler.h simplewallet: lock console on inactivity 2019-08-28 19:01:48 +00:00
copyable_atomic.h
file_io_utils.h epee.string_tools: add conversion between UTF-8 and UTF-16 2018-06-28 09:40:26 +09:00
fnv1.h wallet: wipe seed from memory where appropriate 2018-08-16 09:17:52 +00:00
global_stream_operators.h
gzip_encoding.h
hex.h Update 2019 copyright 2019-03-05 22:05:34 +01:00
hmac-md5.h
include_base_utils.h
int-util.h Update 2019 copyright 2019-03-05 22:05:34 +01:00
math_helper.h epee: use boost/timer/timer.hpp, boost/timer.hpp is deprecated 2019-04-18 15:12:34 +00:00
md5_l.h
md5_l.inl
md5global.h
memwipe.h Update 2019 copyright 2019-03-05 22:05:34 +01:00
misc_language.h default initialize rpc structures 2019-03-04 22:38:03 +00:00
misc_log_ex.h Pruning 2019-01-22 20:30:51 +00:00
misc_os_dependent.h blockchain_stats: don't use gmtime_r on Windows 2018-11-21 00:50:53 +00:00
mlocker.h various: do not propagate exception through dtor 2018-11-15 15:53:21 +00:00
pragma_comp_defs.h
profile_tools.h move includes around to lessen overall load 2017-12-16 22:46:38 +00:00
readline_buffer.h simplewallet: lock console on inactivity 2019-08-28 19:01:48 +00:00
reg_exp_definer.h move includes around to lessen overall load 2017-12-16 22:46:38 +00:00
reg_utils.h
rolling_median.h blockchain: keep a rolling long term block weight median 2019-05-02 09:47:01 +00:00
service_impl_base.h
sha1.h
sha1.inl
soci_helper.h
span.h Add missing include 2019-03-31 18:39:25 +02:00
static_initializer.h
stats.h performance_tests: better stats, and keep track of timing history 2019-01-28 15:45:37 +00:00
stats.inl performance_tests: better stats, and keep track of timing history 2019-01-28 15:45:37 +00:00
string_coding.h
string_tools.h epee: support unicode in parsed strings 2019-08-16 17:06:03 +00:00
syncobj.h syncobj.h no longer defines shared_guard, so remove those define's 2019-08-23 08:42:36 +02:00
time_helper.h
tiny_ini.h
to_nonconst_iterator.h
warnings.h
winobj.h
wipeable_string.h Update 2019 copyright 2019-03-05 22:05:34 +01:00
zlib_helper.h