Page History

...

There are cases of course, where the same sequence of random numbers is desirable, such as regression tests of program behavior. Otherwise, generating the same sequence of random numbers may cause a vulnerability.

Compliant Solution

This compliant solution uses the java.security.SecureRandom class in order to produce high quality random numbers.

import java.security.SecureRandom;
import java.security.NoSuchAlgorithmException;
// ...

public static void main (String args[])
{
   try
   {
      SecureRandom number = SecureRandom.getInstance ("SHA1PRNG");
      // generate 20 integers 0..20
      for (int i=0; i<20; i++) {
         System.out.println(number.nextInt(21));
      }
   }
   catch (NoSuchAlgorithmException nsae) { /* handle */ }
}

Exceptions

MSC30-EX1: Using a null seed value (as opposed to reusing it) may improve security marginally but should only be used for non-critical applications. Java's default seed uses the system's time in milliseconds. This solution exception is not recommended for applications requiring high security (for instance, session IDs should not use this). When used, explicit documentation of this exception is encouraged.

import java.util.Random;
// ...

Random number = new Random();
int n;
//...
for (int i=0; i<20; i++)
{
   // re-seed generator
   number = new Random();
   // generate another random integer in the range [0,20]
   n = number.nextInt(21);
   System.out.println(n);
}

For noncritical cases, such as adding some randomness to a game, the Random class is considered fine. However, we reiterate that it is the resulting low entropy random numbers are not random enough to be used by for more serious applications, such as cryptography.

Compliant Solution

This compliant solution uses the java.security.SecureRandom class in order to produce high quality random numbers.

...

...

.

...

Risk Assessment

...