[java-support] branch maint-8 updated: JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-8
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=08ff5bec5f9445cb102f539573e937631be9d77d

The following commit(s) were added to refs/heads/maint-8 by this push:
     new 08ff5be  JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators
08ff5be is described below

commit 08ff5bec5f9445cb102f539573e937631be9d77d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 12 08:39:15 2022 -0400

    JSSH-10 - Reconsider direct use of SHA1PRNG in identifier generators
    
    https://shibboleth.atlassian.net/browse/JSSH-10
    
    Backported to old library.
---
 .../impl/RandomIdentifierGenerationStrategy.java   | 23 ++++++----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/impl/RandomIdentifierGenerationStrategy.java b/src/main/java/net/shibboleth/utilities/java/support/security/impl/RandomIdentifierGenerationStrategy.java
index 7723701..7d03503 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/impl/RandomIdentifierGenerationStrategy.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/impl/RandomIdentifierGenerationStrategy.java
@@ -17,7 +17,6 @@
 
 package net.shibboleth.utilities.java.support.security.impl;
 
-import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.Random;
 
@@ -52,13 +51,7 @@ public class RandomIdentifierGenerationStrategy implements IdentifierGenerationS
      * bytes, and the encoder is set to a {@link Hex}.
      */
     public RandomIdentifierGenerationStrategy() {
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-            sizeOfIdentifier = 16;
-            encoder = new Hex();
-        } catch (final NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA1PRNG is required to be supported by the JVM but is not", e);
-        }
+        this(16);
     }
 
     /**
@@ -68,15 +61,11 @@ public class RandomIdentifierGenerationStrategy implements IdentifierGenerationS
      * @param identifierSize number of random bytes in identifier
      */
     public RandomIdentifierGenerationStrategy(final int identifierSize) {
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-            sizeOfIdentifier =
-                    Constraint.isGreaterThan(0, identifierSize,
-                            "Number of bytes in the identifier must be greater than 0");
-            encoder = new Hex();
-        } catch (final NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA1PRNG is required to be supported by the JVM but is not", e);
-        }
+        random = new SecureRandom();
+        sizeOfIdentifier =
+                Constraint.isGreaterThan(0, identifierSize,
+                        "Number of bytes in the identifier must be greater than 0");
+        encoder = new Hex();
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.