[JIRA] (JSSH-10) Reconsider direct use of SHA1PRNG in identifier generators

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *resolved* as *Fixed*

There's another ticket open on the more general problem that this identifier layer isn't terribly well thought out or used but for the purposes of this issue, I've gone ahead for now and changed the class to just instantiate new SecureRandom() in place of the hardcoded algorithm.

It's apparently not even true that the original one was actually a required one for Java, so this code could have outright broken the IdP on esoteric JVMs I guess.

As far as I can tell, the places we generate keys are really all handled through JCE providers for key generation, so I don't think we need to mess with the getInstanceStrong() approach they added for "special cases".

I will apply this same fix to the branch as well in the old library.

Shibboleth Shared - Java ( https://shibboleth.atlassian.net/browse/JSSH?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JSSH-10?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 ) JSSH-10 ( https://shibboleth.atlassian.net/browse/JSSH-10?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 ) Reconsider direct use of SHA1PRNG in identifier generators ( https://shibboleth.atlassian.net/browse/JSSH-10?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 )

Change By: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Resolution: Fixed Status: Reopened Resolved

( https://shibboleth.atlassian.net/browse/JSSH-10#add-comment?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JSSH-10#add-comment?atlOrigin=eyJpIjoiNjM3NDE4MjFjNWZmNDQwNGE1ZjM0YmE0YmY3OTU2MjEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100208- sha1:399748d )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221012/ba43ef1a/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-9ce6f7a9-553e-4a05-851b-2700d7ae5ab2
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221012/ba43ef1a/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f7154894-e83a-47b0-846b-e24fc98593d3
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221012/ba43ef1a/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-076bf003-bf65-4e0d-8269-e3fa75c3ab53
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221012/ba43ef1a/attachment-0005.png>