Page History

Random number generation depends on a source of entropy such as signals, devices, or hardware inputs from hardware. Secure random number generation is also addressed by the rule MSC02-J. Generate strong random numbers.

The java.security.SecureRandom class is widely used for generating cryptographically strong random numbers. According to the java.security file present in the JREJava Runtime Environment's lib\/security folder [API 2013]:

Select the source of seed data for SecureRandom. By default an attempt is made to use the entropy gathering device specified by the securerandom.source property. If an exception occurs when accessing the URL then the traditional system/thread activity algorithm is used.

On Solaris and Linux systems, if file:/dev/urandom is specified and it exists, a special SecureRandom implementation is activated by default. This "NativePRNG" reads random bytes directly from /dev/urandom. On Windows systems, the URLs file:/dev/random and file:/dev/urandom enables enable use of the Microsoft CryptoAPI seed functionality.

An adversary should not be able to determine the original seed given several samples of random numbers. If that this restriction is not ensuredviolated, all future random numbers may be successfully predicted by the adversary.

Noncompliant Code Example

This noncompliant code example constructs a secure random number generator that is seeded with the specified seed bytes.:

 SecureRandom random = new SecureRandom(String.valueOf(new Date().getTime()).getBytes());

This constructor searches a registry of security providers and returns the first provider that supports secure random number generation. If no such provider exists, an implementation-specific default is selected. Furthermore, the default system-provided seed is overridden by a seed provided by the programmer. The Using the current system time used as the seed is predictable and can result in the generation of random numbers with insufficient entropy.

Compliant Solution 

Prefer the no-argument constructor of SecureRandom that uses the system-specified seed value to generate a 128-byte-long random number..

byte[] randomBytes = new byte[128];
SecureRandom random = new SecureRandom("SHA1PRNG", "SUN");
random.nextBytes(randomBytes);

Note that use of the setSeed() method to seed the SecureRandom object prior to invoking nextBytes() is insecure because that bypasses the standard system generated seeding mechanism. It is also recommended to specify the exact random number generator and provider for better portabilitySpecifying the exact RNG algorithm and provider can improve portability, perhaps when complying with a design or regulation that mandates a particular algorithm. However, if no arguments are provided, the constructor will provide a default secure RNG.

Applicability

Insufficiently secure random numbers enable attackers to gain specific information about the context in which they are used. For instance, an attacker may be able to guess a cryptographic key.

Insecure random numbers are useful in some contexts that do not require security. These are addressed in the exceptions to MSC02-J. Generate strong random numbers.

Bibliography

...

Image Modified Image Modified  Image Modified