So, I am new to cryptography and I was learning about
SecureRandom and all of the ways it calls implementations with or without providers.
When I looked up some sites for information, it says not to use providers because if the provider is outdated or not available in a system, then the application must be prepared to handle an exception.
However, many say use providers to outrun the risk of choosing a bad implementation like a blocking one.
In the Java docs, I read that when you specify a particular provider even if the framework has higher priority providers that offer the same implementation, it will only go to the mentioned provider to get the implementation. That does not sound appealing though.
So, should you user
getInstance() with providers or not? Which is better?