Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How to generate a secure random number bit length is 256 bits using Java. What is the different between:

SecureRandom random = new SecureRandom(); 
                and
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

With the first line, you let the JVM use the "secure random" implementation which is registered as default implementation in that JVM, whereas the second line forces the use of a specific implementation.

It is recommended to use the default (new SecureRandom()) because a specific Java-compatible platform could have a dedicated provider which is "better" (e.g. if the platform has a hardware RNG, the JVM might have been configured to use it with a specific implementation of the SecureRandomSpi interface, which you get by selecting the "default provider" but not by enforcing the use of "SHA1PRNG").

share|improve this answer
    
The guys at Cigital have a different view, suggesting that different providers might have different usage requirements, so you should always specify a named provider which you know how to use securely. –  Michael Mar 2 '13 at 14:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.