sdrapkin/SecurityDriven.Inferno

Unable to use Inferno on MacOS or Linux

loligans opened this issue ยท 5 comments

@sdrapkin I ran into an issue while on MacOS where I cannot use the NETStandard library due to a bcrypt.dll reference missing.

I was able to fix it by hacking up CryptoRandom with RNGCryptoServiceProvider. I simply replaced CryptoRandom.NextBytes with RNGCryptoServiceProvider.GetBytes.

@loligans Thanks for reporting this issue. Making CryptoRandom work on non-Windows platforms is among the improvements I plan to implement.

I think there should be message in readme/nuget info to inform users that it will not work on Linux etc, I used it to build web api .net 5 license system only to find out that problem after I deployed it to Heroku...
I use SuiteB.Encrypt()
had to change all the code, then I found this Issue and tried loligans solution and it seems to work now, CryptoRandom class was removed, hope it still got some security left in it ๐Ÿ˜„.
Some kind of official quick fix would be nice...

wmate commented

Hi folks, we also are running into this issue (used for linux/windows encryption interop). @loligans what would it take to convince you to submit a pull request? ;)

That might help @sdrapkin and in the meantime help out us community folks who may not be as comfortable ensuring our implementations of randomness are random enough.

I wouldn't mind submitting a PR but I don't think my fix would meet the Inferno standards when it comes to security.

Inferno v1.6.4 was released on Nuget - should fix this issue.