[JIRA] (JSSH-24) Default SecureRandom provider may be blocking

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JSSH-24 ( https://shibboleth.atlassian.net/browse/JSSH-24?atlOrigin=eyJpIjoiY2QwOWUzYjk1MjNlNDQ3MTk1MTNmNTkwNDdjMmQwNjciLCJwIjoiaiJ9 )

Re: Default SecureRandom provider may be blocking ( https://shibboleth.atlassian.net/browse/JSSH-24?atlOrigin=eyJpIjoiY2QwOWUzYjk1MjNlNDQ3MTk1MTNmNTkwNDdjMmQwNjciLCJwIjoiaiJ9 )

This is a pretty good summary of current state.

https://www.synopsys.com/blogs/software-security/proper-use-of-javas-securerandom/ ( https://www.synopsys.com/blogs/software-security/proper-use-of-javas-securerandom/ )

Notably, they added yet more settings in java.security for dealing with this.

Possibly not new, but securerandom.source is there to point to the secure entropy source, but the claim (unproven) is that the NativePRNGBlocking provider doesn’t honor it (this seems kind of hard to believe).

In addition, the trigger for getInstanceStrong is this line:

securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN

So it’s still possible to control it, but it’s clear that using the constructor alone is better, and you get NativePRNG (or the SHA1 version on Windows), and that only blocks on the seed and honors the property to point to non-blocking sources.

The upshot is we’re doing it right now, but need to ensure we can control the provider at runtime in the event they screw with this again.

( https://shibboleth.atlassian.net/browse/JSSH-24#add-comment?atlOrigin=eyJpIjoiY2QwOWUzYjk1MjNlNDQ3MTk1MTNmNTkwNDdjMmQwNjciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JSSH-24#add-comment?atlOrigin=eyJpIjoiY2QwOWUzYjk1MjNlNDQ3MTk1MTNmNTkwNDdjMmQwNjciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100214- sha1:6795dbd )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230208/afbd3f67/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-6d05550c-d72f-46e7-b2cc-7e8eb2db3dd8
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230208/afbd3f67/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9e6d753a-1b59-406b-b480-dcaa1447921b
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230208/afbd3f67/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-fc4fad4b-fe44-4a06-9342-eda33b6bb3eb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230208/afbd3f67/attachment-0005.png>