glm-5.2 f43246b978 vault: use OsRng for AES-GCM IV and salt generation ...

Replace rand::random() with rand::rngs::OsRng for cryptographic nonce
and salt generation in encryption.rs. rand::random() uses thread-local
RNG which may not be a CSPRNG on all platforms; OsRng reads from the
OS entropy source, preventing catastrophic IV reuse under AES-GCM.

Drift item #1 (security-critical).

2026-06-23 13:09:07 +00:00

8.8 KiB

Raw Blame History

View Raw