Public/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2025-11-11 11:08:02 -06:00
Code Activity

Windows: Use BCryptGenRandom instead of deprecated CryptGenRandom to generate secure random bytes

Browse Source
This commit is contained in:
Mounir IDRASSI
2024-11-13 02:04:13 +01:00
parent a1ade61c59
commit ec4b44c238
1 changed files with 21 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
src/Common/Random.c
View File

@@ -19,6 +19,7 @@
#include "Crypto\jitterentropy.h" #include "Crypto\jitterentropy.h"
#include "Crypto\rdrand.h" #include "Crypto\rdrand.h"
#include <Strsafe.h> #include <Strsafe.h>
#include <bcrypt.h>
static unsigned __int8 buffer[RNG_POOL_SIZE]; static unsigned __int8 buffer[RNG_POOL_SIZE];
static unsigned char *pRandPool = NULL; static unsigned char *pRandPool = NULL;
@@ -89,16 +90,17 @@ BOOL volatile bThreadTerminate = FALSE; /* This variable is shared among thread'
HANDLE hNetAPI32 = NULL; HANDLE hNetAPI32 = NULL;
// CryptoAPI // CryptoAPI
BOOL CryptoAPIAvailable = FALSE;
DWORD CryptoAPILastError = ERROR_SUCCESS; DWORD CryptoAPILastError = ERROR_SUCCESS;
HCRYPTPROV hCryptProv;
typedef DWORD (WINAPI *RtlNtStatusToDosError_t)(NTSTATUS);
RtlNtStatusToDosError_t pRtlNtStatusToDosError = NULL;
/* Init the random number generator, setup the hooks, and start the thread */ /* Init the random number generator, setup the hooks, and start the thread */
int RandinitWithCheck ( int* pAlreadyInitialized) int RandinitWithCheck ( int* pAlreadyInitialized)
{ {
BOOL bIgnoreHookError = FALSE; BOOL bIgnoreHookError = FALSE;
DWORD dwLastError = ERROR_SUCCESS; DWORD dwLastError = ERROR_SUCCESS;
HMODULE ntdll;
if (GetMaxPkcs5OutSize() > RNG_POOL_SIZE) if (GetMaxPkcs5OutSize() > RNG_POOL_SIZE)
TC_THROW_FATAL_EXCEPTION; TC_THROW_FATAL_EXCEPTION;
@@ -143,14 +145,14 @@ int RandinitWithCheck ( int* pAlreadyInitialized)
goto error; goto error;
} }
if (!CryptAcquireContext (&hCryptProv, NULL, MS_ENHANCED_PROV, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) ntdll = GetModuleHandleW(L"ntdll.dll");
{ if (!ntdll) {
CryptoAPIAvailable = FALSE; // If ntdll.dll is not found, return a fallback error code
CryptoAPILastError = GetLastError (); CryptoAPILastError = ERROR_MOD_NOT_FOUND;
goto error; goto error;
} }
else else
CryptoAPIAvailable = TRUE; pRtlNtStatusToDosError = (RtlNtStatusToDosError_t)GetProcAddress(ntdll, "RtlNtStatusToDosError");
if (!(PeriodicFastPollThreadHandle = (HANDLE) _beginthreadex (NULL, 0, PeriodicFastPollThreadProc, NULL, 0, NULL))) if (!(PeriodicFastPollThreadHandle = (HANDLE) _beginthreadex (NULL, 0, PeriodicFastPollThreadProc, NULL, 0, NULL)))
goto error; goto error;
@@ -199,12 +201,6 @@ void RandStop (BOOL freePool)
hNetAPI32 = NULL; hNetAPI32 = NULL;
} }
if (CryptoAPIAvailable)
{
CryptReleaseContext (hCryptProv, 0);
CryptoAPIAvailable = FALSE;
CryptoAPILastError = ERROR_SUCCESS;
}
hMouse = NULL; hMouse = NULL;
hKeyboard = NULL; hKeyboard = NULL;
@@ -675,6 +671,7 @@ BOOL SlowPoll (void)
DWORD dwSize, status; DWORD dwSize, status;
LPWSTR lpszLanW, lpszLanS; LPWSTR lpszLanW, lpszLanS;
int nDrive; int nDrive;
NTSTATUS bStatus = 0;
/* Find out whether this is an NT server or workstation if necessary */ /* Find out whether this is an NT server or workstation if necessary */
if (isWorkstation == -1) if (isWorkstation == -1)
@@ -783,18 +780,16 @@ BOOL SlowPoll (void)
CloseHandle (hDevice); CloseHandle (hDevice);
} }
// CryptoAPI: We always have a valid CryptoAPI context when we arrive here but
// we keep the check for clarity purpose bStatus = BCryptGenRandom(NULL, buffer, sizeof(buffer), BCRYPT_USE_SYSTEM_PREFERRED_RNG);
if ( !CryptoAPIAvailable ) if (NT_SUCCESS(bStatus))
return FALSE;
if (CryptGenRandom (hCryptProv, sizeof (buffer), buffer))
{ {
RandaddBuf (buffer, sizeof (buffer)); RandaddBuf (buffer, sizeof (buffer));
} }
else else
{ {
/* return error in case CryptGenRandom fails */ /* return error in case BCryptGenRandom fails */
CryptoAPILastError = GetLastError (); CryptoAPILastError = pRtlNtStatusToDosError (bStatus);
return FALSE; return FALSE;
} }
@@ -838,6 +833,7 @@ BOOL FastPoll (void)
MEMORYSTATUSEX memoryStatus; MEMORYSTATUSEX memoryStatus;
HANDLE handle; HANDLE handle;
POINT point; POINT point;
NTSTATUS bStatus = 0;
/* Get various basic pieces of system information */ /* Get various basic pieces of system information */
RandaddIntPtr (GetActiveWindow ()); /* Handle of active window */ RandaddIntPtr (GetActiveWindow ()); /* Handle of active window */
@@ -928,18 +924,16 @@ BOOL FastPoll (void)
RandaddBuf ((unsigned char *) &dwTicks, sizeof (dwTicks)); RandaddBuf ((unsigned char *) &dwTicks, sizeof (dwTicks));
} }
// CryptoAPI: We always have a valid CryptoAPI context when we arrive here but
// we keep the check for clarity purpose bStatus = BCryptGenRandom(NULL, buffer, sizeof(buffer), BCRYPT_USE_SYSTEM_PREFERRED_RNG);
if ( !CryptoAPIAvailable ) if (NT_SUCCESS(bStatus))
return FALSE;
if (CryptGenRandom (hCryptProv, sizeof (buffer), buffer))
{ {
RandaddBuf (buffer, sizeof (buffer)); RandaddBuf (buffer, sizeof (buffer));
} }
else else
{ {
/* return error in case CryptGenRandom fails */ /* return error in case BCryptGenRandom fails */
CryptoAPILastError = GetLastError (); CryptoAPILastError = pRtlNtStatusToDosError (bStatus);
return FALSE; return FALSE;
} }