How to generate a secure random number bit length is 256 bits using Java. What is the different between:
SecureRandom random = new SecureRandom(); and SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
With the first line, you let the JVM use the "secure random" implementation which is registered as default implementation in that JVM, whereas the second line forces the use of a specific implementation.
It is recommended to use the default (
new SecureRandom()) because a specific Java-compatible platform could have a dedicated provider which is "better" (e.g. if the platform has a hardware RNG, the JVM might have been configured to use it with a specific implementation of the
SecureRandomSpi interface, which you get by selecting the "default provider" but not by enforcing the use of
Okay I like to correct a few things about SecureRandom I guess my version was different from the current one it's actually does get it's seeds from a pretty unpredictable location something with thread yield sleep intervals. Still it always keeps reusing the same 20 seeds over and over yes it seems impossible at this point to figure it out and probably is due to the fact most people will give up, but now it's like a deck of RNG's if someone is crazy enough and you don't re-seed it ever they can still figure out all the seeds.
The only difference between
new Random() and
new SecureRandom() is how the seed is picked out in Random it uses milliseconds in SecureRandom it uses nanoseconds which are much harder to predict actually then milliseconds.
But only a extra 1 million attempts or so loops to figure it out and synchronize the random number generator.
You should just re-seed your RNG every few calls and even this could be predicted if someone studies it long enough you can't re-seed them with a similar RNG since it also has the flaw. Because if someone studies it long enough they will figure it out although it's very delicate this point and pretty luck related but hey there are people who do this, just requires getting the timings just right.
Although I know you didn't ask about
new Random() just trying to state the fact it's not as Secure as you may think a better random number generator would use dust from your RAM for example at any random location which will include many factors people from the outside cannot figure out.. like where the Java VM is loaded in memory unless they hijack your remote system that is which pretty much makes anything you do unsecure haha.