[java-shib-shared] branch main updated: JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=4d97e9a83b40853d834da3e94d1a487d2cdb02e7

The following commit(s) were added to refs/heads/main by this push:
     new 4d97e9a8 JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators
4d97e9a8 is described below

commit 4d97e9a83b40853d834da3e94d1a487d2cdb02e7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 12 08:32:42 2022 -0400

    JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators
    
    https://shibboleth.atlassian.net/browse/JSSH-10
---
 .../impl/RandomIdentifierGenerationStrategy.java   | 23 ++++++----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
index 94d3702b..57feb7f5 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
@@ -17,7 +17,6 @@
 
 package net.shibboleth.shared.security.impl;
 
-import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.Random;
 
@@ -52,13 +51,7 @@ public class RandomIdentifierGenerationStrategy implements IdentifierGenerationS
      * bytes, and the encoder is set to a {@link Hex}.
      */
     public RandomIdentifierGenerationStrategy() {
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-            sizeOfIdentifier = 16;
-            encoder = new Hex();
-        } catch (final NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA1PRNG is required to be supported by the JVM but is not", e);
-        }
+        this(16);
     }
 
     /**
@@ -68,15 +61,11 @@ public class RandomIdentifierGenerationStrategy implements IdentifierGenerationS
      * @param identifierSize number of random bytes in identifier
      */
     public RandomIdentifierGenerationStrategy(final int identifierSize) {
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-            sizeOfIdentifier =
-                    Constraint.isGreaterThan(0, identifierSize,
-                            "Number of bytes in the identifier must be greater than 0");
-            encoder = new Hex();
-        } catch (final NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA1PRNG is required to be supported by the JVM but is not", e);
-        }
+        random = new SecureRandom();
+        sizeOfIdentifier =
+                Constraint.isGreaterThan(0, identifierSize,
+                        "Number of bytes in the identifier must be greater than 0");
+        encoder = new Hex();
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.