PR #538: Use RNGCryptoServiceProvider for crypto headers

- Use RNGCryptoServiceProvider for crypto headers
- Dispose RNG service after use in ZipCrypto

Author: piksel

src/ICSharpCode.SharpZipLib/Encryption/PkzipClassic.cs

@@ -444,8 +444,10 @@ public override byte[] Key
 		public override void GenerateKey()
 		{
 			key_ = new byte[12];
-			var rnd = new Random();
-			rnd.NextBytes(key_);
+			using (var rng = new RNGCryptoServiceProvider())
+			{
+				rng.GetBytes(key_);
+			}
 		}
 
 		/// <summary>

src/ICSharpCode.SharpZipLib/Zip/ZipFile.cs

@@ -3727,8 +3727,10 @@ private static void CheckClassicPassword(CryptoStream classicCryptoStream, ZipEn
 		private static void WriteEncryptionHeader(Stream stream, long crcValue)
 		{
 			byte[] cryptBuffer = new byte[ZipConstants.CryptoHeaderSize];
-			var rnd = new Random();
-			rnd.NextBytes(cryptBuffer);
+			using (var rng = new RNGCryptoServiceProvider())
+			{
+				rng.GetBytes(cryptBuffer);
+			}
 			cryptBuffer[11] = (byte)(crcValue >> 24);
 			stream.Write(cryptBuffer, 0, cryptBuffer.Length);
 		}

src/ICSharpCode.SharpZipLib/Zip/ZipOutputStream.cs

@@ -5,6 +5,7 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Security.Cryptography;
 
 namespace ICSharpCode.SharpZipLib.Zip
 {
@@ -633,8 +634,11 @@ private void WriteEncryptionHeader(long crcValue)
 			InitializePassword(Password);
 
 			byte[] cryptBuffer = new byte[ZipConstants.CryptoHeaderSize];
-			var rnd = new Random();
-			rnd.NextBytes(cryptBuffer);
+			using (var rng = new RNGCryptoServiceProvider())
+			{
+				rng.GetBytes(cryptBuffer);
+			}
+
 			cryptBuffer[11] = (byte)(crcValue >> 24);
 
 			EncryptBlock(cryptBuffer, 0, cryptBuffer.Length);