Commit 2fac14da authored by Christopher Dykes's avatar Christopher Dykes Committed by Facebook Github Bot

Request lower privilege crypt context when generating random numbers

Summary: Without this flag, we were unintentionally requesting a context with access to private keys.

Reviewed By: yfeldblum

Differential Revision: D4155525

fbshipit-source-id: f33d18451b06e32b81d03bf6180efc1671cfa204
parent c1c9a06b
...@@ -42,7 +42,12 @@ void readRandomDevice(void* data, size_t size) { ...@@ -42,7 +42,12 @@ void readRandomDevice(void* data, size_t size) {
static folly::once_flag flag; static folly::once_flag flag;
static HCRYPTPROV cryptoProv; static HCRYPTPROV cryptoProv;
folly::call_once(flag, [&] { folly::call_once(flag, [&] {
if (!CryptAcquireContext(&cryptoProv, nullptr, nullptr, PROV_RSA_FULL, 0)) { if (!CryptAcquireContext(
&cryptoProv,
nullptr,
nullptr,
PROV_RSA_FULL,
CRYPT_VERIFYCONTEXT)) {
if (GetLastError() == NTE_BAD_KEYSET) { if (GetLastError() == NTE_BAD_KEYSET) {
// Mostly likely cause of this is that no key container // Mostly likely cause of this is that no key container
// exists yet, so try to create one. // exists yet, so try to create one.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment