1
$\begingroup$

I'm looking for some PRNGs and – as I have been using Java for a long period of time – I thought that the BitInteger class, together with the Random class, could both generate some large pseudo random numbers.

Are the algorithms behind those generations cryptographically secure, or is it just some sort of a + (b - c) mod d or similar operation?

$\endgroup$
5
  • $\begingroup$ Exactly what algorithms are you considering in the phrase of the question ending in a question mark? $\endgroup$
    – fgrieu
    Commented Mar 24, 2012 at 9:01
  • 5
    $\begingroup$ Just use the SecureRandom class. $\endgroup$ Commented Mar 24, 2012 at 9:49
  • $\begingroup$ I was considering the algorithms behind the Random and BigInteger class. $\endgroup$
    – Andre
    Commented Mar 30, 2012 at 11:18
  • $\begingroup$ @vlad you were considering wrong :) $\endgroup$
    – Maarten Bodewes
    Commented Apr 5, 2012 at 1:27
  • 1
    $\begingroup$ BigInteger does not contain PRNG code at all. It uses RNGs only. Btw, the statement to use SecureRandom is even in the JavaDoc of the Random class. Last sentence of the first paragraph $\endgroup$
    – tylo
    Commented Jun 12, 2014 at 10:53

1 Answer 1

6
$\begingroup$

Presuming this documentation is correct, the answer is no, these numbers are not cryptographically secure. The Random class uses a linear congruential formula with a 48 bit seed. For most purposes it is not enough even if you only require 48 bit security. Given a fairly low number of outputs from a LCG, it is possible to derive the seed, even if only a few bits of each seed iteration are used. That question has been answered here.

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.