Creating secure PIN in Java

Question

I need to create cryptographically secure PIN number in Java using secret id for each user.

This simple approach comes to mind:

int getPin(String secretUserIdStr)
{
    String pepper = "randomPepper...";
    String seed = secretUserIdStr + pepper;

    SecureRandom sr = SecureRandom.getInstance("SHA1PRNG", "SUN");  
    sr.setSeed(seed.getBytes());

    return sr.nextInt(10000);
}

Is this good idea? Is it secure? If not, what is the best practice?

Answer 1

Don't do it. Reason: general principles. ("Don't roll your own crypto.")

You're deriving a key (something secret) from something else secret. You don't need to invent a procedure for yourself. Go with an established key derivation function. Something like PBKDF2.