mardi 5 juillet 2016

Is it okay to fallback on Random if SecureRandom can't be used?

I have a Java library which has a class (ShrubSecureRandom) which uses SecureRandom to generate numbers, sentences, and the like.
The method it uses to get the Random class goes like this:

public Random getSRGInstance() {
    Random instanceToReturn;
    try {
        instanceToReturn = SecureRandom.getInstance("SHA1PRNG");
    } catch (Exception e) {
        System.out.println("SecureRandom algorithm not found! Reverting to INSECURE Random instance...");
        instanceToReturn = new Random();
    }
    return instanceToReturn;
}

If the code gets an exception while creating the SecureRandom class (NoSuchAlgorithmException, etc.), it will use a Random class instead.
My question is: is this safe? If not, what should I do instead?




Aucun commentaire:

Enregistrer un commentaire