Databases
StackOverflow2013
Postsdbo
PODifference between java.util.Random and java.security.SecureRandom
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PODifference between java.util.Random and java.security.SecureRandom
    primarykey
    data
    text
    <p>My team got handed over some server side code (in Java) that generates random tokens and I have a question regarding the same -</p> <p>The purpose of these tokens is fairly sensitive - used for session id, password reset links etc. So they do need to be cryptographically random to avoid somebody guessing them or brute force them feasibly. The token is a "long" so it is 64 bits long.</p> <p>The code currently uses the <code>java.util.Random</code> class to generate these tokens. The documentation ([<a href="http://docs.oracle.com/javase/7/docs/api/java/util/Random.html][1]" rel="noreferrer">http://docs.oracle.com/javase/7/docs/api/java/util/Random.html][1]</a>) for <code>java.util.Random</code> clearly states the following: </p> <blockquote> <p>Instances of java.util.Random are not cryptographically secure. Consider instead using SecureRandom to get a cryptographically secure pseudo-random number generator for use by security-sensitive applications.</p> </blockquote> <p>However, the way the code is currently using <code>java.util.Random</code> is this - It instantiates the <code>java.security.SecureRandom</code> class and then uses the <code>SecureRandom.nextLong()</code> method to obtain the seed that is used for instantiating the <code>java.util.Random</code>class. Then it uses <code>java.util.Random.nextLong()</code> method to generate the token.</p> <p>So my question now - Is it still insecure given that the <code>java.util.Random</code> is being seeded using <code>java.security.SecureRandom</code>? Do I need to modify the code so that it uses <code>java.security.SecureRandom</code> exclusively to generate the tokens?</p> <p>Currently the code seed's the <code>Random</code> once at startup</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USRobert Harvey
    1. USuser967973
    plurals
    1. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. This table or related slice is empty.
      1. VTUpMod
    1. COOnce seeded, output from java.util.Random is deterministic sequence of numbers. You may not want that.
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. USPeter Štibraný
    2. CODoes the code seed the `Random` once at startup, or does it seed a new one for every token? Hopefully, this is a stupid question, but i thought i'd check.
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. USTom Anderson
    3. CORandom only has a 48-bit internal state and will repeat after 2^48 calls to nextLong() which means that it won't produce all possible `long` or `double` values.
      singulars
      1. PODifference between java.util.Random and java.security.SecureRandom
      1. USPeter Lawrey
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload