Vinnie Falco 749e54f31b Generated WebSocket masks use a secure PRNG by default: ...

This resolves a medium vulnerability described in the
Beast Hybrid Assessment Report by Bishop Fox, where masks generated
for use with outgoing WebSocket client frames use an insufficient
source of entropy and a non-cryptographically secure pseudo-random
number generator.

By default, all newly constructed WebSocket streams will use a
uniquely seeded secure PRNG (ChaCha20 in counter mode). As this may
result in increased CPU resource consumption, the function
websocket::stream::secure_prng() may be used to select a faster but
less secure PRNG, for the case where the caller knows that the secure
generator is not necessary.

On some systems, std::random_device may produce insufficient entropy
to securely seed the PRNG. As this condition cannot be detected by
Beast, callers may use the function websocket::seed_prng() called
once at startup to provide at least 256 bits of entropy which will
be used to uniquely seed all subsequent PRNGs.

2018-07-08 15:20:05 -07:00

..

beast

Generated WebSocket masks use a secure PRNG by default:

2018-07-08 15:20:05 -07:00

beast.hpp

config.hpp is not a public header

2017-10-10 07:49:12 -07:00