java securt 视频,SecureRandom在Java中安全种子

Is this piece of code safe?

SecureRandom randomizer = new SecureRandom(String.valueOf(new Date().getTime()).getBytes());

Is this the right way to instance the seed of secure random?

解决方案

No, you should avoid the SecureRandom(byte[]) constructor. It is both unsafe and non-portable.

It is non-portable because it behaves differently on Windows vs. other operating systems.

On most OSes, the default algorithm is "NativePRNG", which obtains random data from the OS (usually "/dev/random") and ignores the seed you provide.

On Windows, the default algorithm is "SHA1PRNG", which combines your seed with a counter and computes a hash of the result.

This is bad news in your example, because the input (the current UTC time in milliseconds) has a relatively small range of possible values. For example if an attacker knows that the RNG was seeded in the last 48 hours, they can narrow the seed down to less than 228 possible values, i.e. you have only 27 bits of entropy.

If on the other hand you had used the default SecureRandom() constructor on Windows, it would have called the native CryptoGenRandom function to get a 128-bit seed. So by specifying your own seed you have weakened the security.

If you really want to override the default seed (e.g. for unit testing) you should also specify the algorithm. E.g.

SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");

sr.setSeed("abcdefghijklmnop".getBytes("us-ascii"));

java securt 视频,SecureRandom在Java中安全种子相关推荐

Java自学视频整理(持续更新中...)
1.Java基础视频 <张孝祥JAVA视频教程>完整版[RMVB](东西网) 历经5年锤炼(史上最适合初学者入门的Java基础视频)(传智播客) 张孝祥2010年贺岁视频:Java高新技术 ...
java 取视频第一帧,java获取视频的第一帧
//------------maven配置文件--------------- org.bytedeco javacv 0.8 /** * 获取指定视频的帧并保存为图片至指定目录 * @param vi ...
python vs java 搞笑视频_Python VS Java，谁能笑到最后?
一些开发人员声称Python比Java更有生产力.但更应先说明的是:Python和Java有什么区别? Python VS Java 在学习中有迷茫不知如何学习的朋友小编推荐一个学python的学习裙 ...
redis java 集成视频_redis(6)-java集成二
使用Jedis框架: 创建maven工程,引入依赖 redis.clients jedis 2.9.0 Demo代码如下: import java.util.HashMap; import java. ...
毕老师JAVA基础视频学习日志——Java开发前奏
1.基础常识 1.1. 软件开发软件:一系列按照特定顺序组织的计算机数据和指令的集合.分为系统软件和应用软件. 开发:就是制作软件. 1.2. 人机交互人机交互:就是人与计算机 ...
java获取视频真实地址,Java版蓝奏云真实地址获取
Java版蓝奏云真实地址获取,支持密码文件下载 Tools.java package com.lhr; import java.io.*; import java.net.*; /** * * By ...
Java 给视频添加背景音乐 | Java工具
目录前言 Maven依赖环境依赖代码总结前言本文提供给视频添加背景音乐的java工具,一如既往的实用主义. Maven依赖 <dependency><groupId> ...
python vs java 搞笑视频_Python和Java该学哪个？别纠结了700集视频合集，限时分享...
Java还是Python这确实是个难题.如果问Java程序员一定会告诉你先学Java,如果问Python程序员一定会告诉你先学python.今天小编来给你分析一下.你到底适合学哪个? 本文内容要点: ...
java map key是否存在_java中如何判断map集合中是否存在key
有两种方法可以判断map集合中是否存在某个key. 方法1:直接使用java api提供的containsKey(): 方法2:循环遍历,逐个比较. java相关视频推荐:java视频具体实现代码如 ...

java securt 视频,SecureRandom在Java中安全种子

java securt 视频,SecureRandom在Java中安全种子相关推荐

最新文章

热门文章