Skip to content

Commit a90aa9f

Browse files
GH470: Synchronize access to a shared KeyPairGenerator, which may not be thread-safe.
The keyPairGenerator object in the MontgomeryCurve is a bouncycastle implementation of the java.security.KeyPairGenerator class. The generateKeyPair method in class org.bouncycastle.jcajce.provider.asymmetric.edec.KeyPairGeneratorSpi is not thread safe, so calling the keyPairGenerator.generateKeyPair method must be synchronized.
1 parent 2c62c72 commit a90aa9f

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

sshd-core/src/main/java/org/apache/sshd/common/kex/MontgomeryCurve.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,9 @@ public Digest createDigest() {
153153
}
154154

155155
public KeyPair generateKeyPair() {
156-
return keyPairGenerator.generateKeyPair();
156+
synchronized (this) {
157+
return keyPairGenerator.generateKeyPair();
158+
}
157159
}
158160

159161
public byte[] encode(PublicKey key) throws InvalidKeyException {

0 commit comments

Comments
 (0)