search

mozilla-services / autograph

Mozilla's digital signature service
https://hub.docker.com/r/mozilla/autograph/
Mozilla Public License 2.0
152 stars 33 forks source link

AUT-251 - Use the same rand in SignHash method #1023

Closed say-yawn closed 1 month ago

say-yawn commented 1 month ago

As part of initializing the contentsignature signer we call conf.GetRand(). This will be either a rand.Reader or crypto11.PKCSRandReader depending on whether or not an HSM is available. However, the SignHash method ends up just using rand.Reader directly, and s.rand goes unused altogether.

Make sure SignHash uses the same rand as the initialized ContentSigner by using s.rand.

Fix AUT-251

say-yawn commented 1 month ago

Decided to merge this without tests because the ContentSignature is only used for integration testing.