Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How to generate a secure random number bit length is 256 bits using Java. What is the different between:

SecureRandom random = new SecureRandom(); 
                and
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
share|improve this question

2 Answers 2

up vote 1 down vote accepted

With the first line, you let the JVM use the "secure random" implementation which is registered as default implementation in that JVM, whereas the second line forces the use of a specific implementation.

It is recommended to use the default (new SecureRandom()) because a specific Java-compatible platform could have a dedicated provider which is "better" (e.g. if the platform has a hardware RNG, the JVM might have been configured to use it with a specific implementation of the SecureRandomSpi interface, which you get by selecting the "default provider" but not by enforcing the use of "SHA1PRNG").

share|improve this answer
    
The guys at Cigital have a different view, suggesting that different providers might have different usage requirements, so you should always specify a named provider which you know how to use securely. –  Michael Mar 2 '13 at 14:13

Okay I like to correct a few things about SecureRandom I guess my version was different from the current one it's actually does get it's seeds from a pretty unpredictable location something with thread yield sleep intervals. Still it always keeps reusing the same 20 seeds over and over yes it seems impossible at this point to figure it out and probably is due to the fact most people will give up, but now it's like a deck of RNG's if someone is crazy enough and you don't re-seed it ever they can still figure out all the seeds.

The only difference between new Random() and new SecureRandom() is how the seed is picked out in Random it uses milliseconds in SecureRandom it uses nanoseconds which are much harder to predict actually then milliseconds.

But only a extra 1 million attempts or so loops to figure it out and synchronize the random number generator.

You should just re-seed your RNG every few calls and even this could be predicted if someone studies it long enough you can't re-seed them with a similar RNG since it also has the flaw. Because if someone studies it long enough they will figure it out although it's very delicate this point and pretty luck related but hey there are people who do this, just requires getting the timings just right.

Although I know you didn't ask about new Random() just trying to state the fact it's not as Secure as you may think a better random number generator would use dust from your RAM for example at any random location which will include many factors people from the outside cannot figure out.. like where the Java VM is loaded in memory unless they hijack your remote system that is which pretty much makes anything you do unsecure haha.

share|improve this answer
    
This may be an answer to some question, but certainly isn't an answer to the question posted by user236501 here. –  ChrisInEdmonton May 12 at 14:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.