[Crypto] Use explicit OsRng for IV and salt generation

[qj0r9j0vc2]

Description

IV and salt generation uses rand::thread_rng() instead of explicit OsRng for cryptographic material.

Locations

• cipherbft/crates/crypto/src/keystore/cipher.rs

  Lines 63 to 68 in 1140ac3

  	}
  	}
  	/// Cipher parameters for AES-128-CTR
  	#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
  	pub struct CipherParams {

• cipherbft/crates/crypto/src/keystore/kdf.rs

  Lines 72 to 77 in 1140ac3

  	Scrypt {
  	/// Derived key length in bytes
  	dklen: u32,
  	/// CPU/memory cost parameter (must be power of 2)
  	n: u32,
  	/// Block size parameter

Severity

Medium - Best practice for cryptographic operations.