Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 4.0

...

Code Block
bgColor#ccccff
import java.security.SecureRandom;
import java.security.NoSuchAlgorithmException;
// ...

public static void main (String args[]) {
   try {
     SecureRandom number = SecureRandom.getInstance("SHA1PRNG");
     // Generate 20 integers 0..20
     for (int i = 0; i < 20; i++) {
       System.out.println(number.nextInt(21));
     }
   } catch (NoSuchAlgorithmException nsae) { 
     // Forward to handler
   }
}

Exceptions

Wiki Markup*MSC02-EX0:* Using the default constructor for {{java.util.Random}} applies a seed value that is "very likely to be distinct from any other invocation of this constructor" \[ [API 2006|AA. References#API 06] \] and may improve security marginally. As a result, it may be used only for noncritical applications operating on nonsensitive data. Java's default seed uses the system's time in milliseconds. When used, explicit documentation of this exception is required.

Code Block
bgColor#ccccff
import java.util.Random;
// ...

Random number = new Random(); // only used for demo purposes
int n;
//...
for (int i = 0; i < 20; i++) {
  // Re-seed generator
  number = new Random();
  // Generate another random integer in the range [0, 20]
  n = number.nextInt(21);
  System.out.println(n);
}

...

CERT C Secure Coding Standard

MSC30-C. Do not use the rand() function for generating pseudorandom numbers

CERT C++ Secure Coding Standard

MSC30-CPP. Do not use the rand() function for generating pseudorandom numbers

MITRE CWE

CWE-327. Use of a broken or risky cryptographic algorithm

 

CWE-330. Use of insufficiently random values

 

CWE-332. Insufficient entropy in PRNG

 

CWE-336. Same seed in PRNG

 

CWE-337. Predictable seed in PRNG

Bibliography

...

[[API 2006AA. References#API 06]

[Class Random

http://java.sun.com/javase/6/docs/api/java/util/Random.html]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="36abe2ca-e6dc-4fd9-85ed-eb8c0842a58b"><ac:plain-text-body><! [CDATA[ [[API 2006AA. References#API 06]]

[Class SecureRandomhttp://java.sun.com/javase/6/docs/api/java/security/SecureRandom.html]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e9550bd7-3d60-462b-a34d-b86233a667a2"><ac:plain-text-body><![CDATA [ [[FindBugs 2008AA. References#FindBugs 08]]

BC. Random objects created and used only once

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ca2f9822-82d9-492f-8ef8-02a1ba855927"><ac:plain-text-body><![CDATA[

[[Monsch 2006AA. References#Monsch 06]]

 ]]></ac:plain-text-body></ac:structured-macro>

...

      49. Miscellaneous (MSC)