...
Code Block | ||
---|---|---|
| ||
import java.security.SecureRandom; import java.security.NoSuchAlgorithmException; // ... public static void main (String args[]) { try { SecureRandom number = SecureRandom.getInstance("SHA1PRNG"); // Generate 20 integers 0..20 for (int i = 0; i < 20; i++) { System.out.println(number.nextInt(21)); } } catch (NoSuchAlgorithmException nsae) { // Forward to handler } } |
Exceptions
*MSC02-EX0:* Using the default constructor for {{ Wiki Markup java.util.Random
}} applies a seed value that is "very likely to be distinct from any other invocation of this constructor" \[ [API 2006|AA. References#API 06] \] and may improve security marginally. As a result, it may be used only for noncritical applications operating on nonsensitive data. Java's default seed uses the system's time in milliseconds. When used, explicit documentation of this exception is required.
Code Block | ||
---|---|---|
| ||
import java.util.Random; // ... Random number = new Random(); // only used for demo purposes int n; //... for (int i = 0; i < 20; i++) { // Re-seed generator number = new Random(); // Generate another random integer in the range [0, 20] n = number.nextInt(21); System.out.println(n); } |
...
MSC30-C. Do not use the rand() function for generating pseudorandom numbers | |
MSC30-CPP. Do not use the rand() function for generating pseudorandom numbers | |
CWE-327. Use of a broken or risky cryptographic algorithm | |
| CWE-330. Use of insufficiently random values |
| CWE-332. Insufficient entropy in PRNG |
| CWE-336. Same seed in PRNG |
| CWE-337. Predictable seed in PRNG |
Bibliography
...
[[API 2006AA. References#API 06]] | http://java.sun.com/javase/6/docs/api/java/util/Random.html] | ||
]]></ac:plain-text-body></ac:structured-macro> | <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="36abe2ca-e6dc-4fd9-85ed-eb8c0842a58b"><ac:plain-text-body><! [CDATA[ [[API 2006AA. References#API 06]] | [Class | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e9550bd7-3d60-462b-a34d-b86233a667a2"><ac:plain-text-body><![CDATA [ [[FindBugs 2008AA. References#FindBugs 08]] | BC. Random objects created and used only once | ]]></ac:plain-text-body></ac:structured-macro> | <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ca2f9822-82d9-492f-8ef8-02a1ba855927"><ac:plain-text-body><![CDATA[ |
[[Monsch 2006AA. References#Monsch 06]] | ]]></ac:plain-text-body></ac:structured-macro> |
...