I am concerned that a SHA-1 PRNG cannot produce an AES-256 cipher key with the expected 256 bits of security, or indeed any secure cipher key where over 165 bits of security are expected.
The SHA-1 PRNG is the only pure-java secure random number generator provided by Java without third-party libraries. (I am fully aware third party libraries exist that offer other algorithms.) An implementation can be seen here. The algorithm starts with a state consisting of 160 bits drawn from an external source. As the algorithm uses this data it keeps track of which byte was last used, a number between one and twenty and requiring another 5 bits of information to represent.
Once the 160 bits are all used up, the next 160 bits are derived by calculating:
state(n+1)= state(n) + SHA1(state(n)) + I(SHA1(state(n))
where I(x)=1 if x=0 and I(x)=0 if x!=1
This is wholly determined by the existing 160 bits of state.
This means that if you give someone 165 bits of information, they can calculate the output from the SHA-1 PRNG at any future time. Therefore if I have an AES-256 cipher and I know the key was generated using SHA-1 PRNG I only have to test 2^165 possible combinations, not 2^256. This would appear to significantly weaken the cipher.
As the law of conservation of information says information can never be created, I see no way an algorithm whose internal state consists of only 165 bits of information can ever output 256 bits of information.
If this is true, and the SHA-1 PRNG as shipped with Java can only generate weak keys, what should one do?
Is there a resource that lists the number of bits of information a Secure PRNG function embodies so one can ensure the algorithm has more bits that the cipher key?