Request lower privilege crypt context when generating random numbers

Summary: Without this flag, we were unintentionally requesting a context with access to private keys.

Reviewed By: yfeldblum

Differential Revision: D4155525

fbshipit-source-id: f33d18451b06e32b81d03bf6180efc1671cfa204

diff --git a/folly/Random.cpp b/folly/Random.cpp
index 8f5e3128d2036952f31ba8efcc73791a139e333b..d4fb39b4ea3a4eaaa1d9140dfe422bcdd610a090 100644 (file)
--- a/folly/Random.cpp
+++ b/folly/Random.cpp
@@ -42,7 +42,12 @@ void readRandomDevice(void* data, size_t size) {
   static folly::once_flag flag;
   static HCRYPTPROV cryptoProv;
   folly::call_once(flag, [&] {
-    if (!CryptAcquireContext(&cryptoProv, nullptr, nullptr, PROV_RSA_FULL, 0)) {
+    if (!CryptAcquireContext(
+            &cryptoProv,
+            nullptr,
+            nullptr,
+            PROV_RSA_FULL,
+            CRYPT_VERIFYCONTEXT)) {
       if (GetLastError() == NTE_BAD_KEYSET) {
         // Mostly likely cause of this is that no key container
         // exists yet, so try to create one.