Skip to content

Commit a46758f

Browse files
committed
The Rfc2898DeriveBytes constructor used is called out as insecure in .NET 7, because it’s insecure to use defaults for the number of iterations and hashing algorithm. The fix is to pass those (secure) values in the versions of .NET that support it.
1 parent b5b1b07 commit a46758f

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

src/ICSharpCode.SharpZipLib/Encryption/ZipAESTransform.cs

+5-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@ public ZipAESTransform(string key, byte[] saltBytes, int blockSize, bool writeMo
7676
_encrPos = ENCRYPT_BLOCK;
7777

7878
// Performs the equivalent of derive_key in Dr Brian Gladman's pwd2key.c
79+
#if NET472_OR_GREATER || NETSTANDARD2_1_OR_GREATER || NETCOREAPP2_0_OR_GREATER
80+
var pdb = new Rfc2898DeriveBytes(key, saltBytes, KEY_ROUNDS, HashAlgorithmName.SHA1);
81+
#else
7982
var pdb = new Rfc2898DeriveBytes(key, saltBytes, KEY_ROUNDS);
83+
#endif
8084
var rm = Aes.Create();
8185
rm.Mode = CipherMode.ECB; // No feedback from cipher for CTR mode
8286
_counterNonce = new byte[_blockSize];
@@ -160,7 +164,7 @@ public byte[] GetAuthCode()
160164
/// </summary>
161165
public byte[] TransformFinalBlock(byte[] inputBuffer, int inputOffset, int inputCount)
162166
{
163-
if(inputCount > 0)
167+
if (inputCount > 0)
164168
{
165169
throw new NotImplementedException("TransformFinalBlock is not implemented and inputCount is greater than 0");
166170
}

0 commit comments

Comments
 (0)