6

Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, isn't it?).

If new SecureRandom() already is secure, what would be the benefit of using SecureRandom.getInstanceStrong() instead?

Is this same kind of difference as between /dev/urandom and /dev/random?

I'm debating this in the following scenario, where I'm mostly concerned about making IV random (for use with AES-GCM):

private final SecureRandom secureRandom = new SecureRandom();

[...]


private byte[] getIv() {
    int ivLength = 12;
    byte[] iv = new byte[ivLength];
    secureRandom.nextBytes(iv);
    return iv;
}

1 Answers1

3

SecureRandom.getInstanceStrong() will ensure that a strong algorithm (securerandom.strongAlgorithms) will is used.

  • It is available since Java version 8. Check your version before starting to use.

  • If no such algorithm is available in running VM, it will throw NoSuchAlgorithmException.

  • This failure is a better practice instead of defaulting into weak security.

kelalaka
  • 49,797
  • 12
  • 123
  • 211
cactusresistance
  • 31
  • 5