JDK-8246613 : Choose the default SecureRandom algo based on registration ordering
- Type: Bug
- Component: security-libs
- Sub-Component: java.security
- Affected Version: 8,11,13,15
- Priority: P3
- Status: Closed
- Resolution: Fixed
- OS: generic
- CPU: generic
- Submitted: 2020-06-04
- Updated: 2022-06-27
- Resolved: 2020-06-12
The Version table provides details related to the release that this issue/RFE will be addressed.
Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.
To download the current JDK release, click here.
Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.
To download the current JDK release, click here.
| JDK 11 | JDK 13 | JDK 14 | JDK 15 | JDK 16 | JDK 8 |
|---|---|---|---|---|---|
| 11.0.8-oracleFixed | 13.0.4Fixed | 14.0.2Fixed | 15 b28Fixed  |
16Fixed |
8u261Fixed |
Related Reports
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
Description
Before the perf enhancement of JDK-7092821, the ordering of provider registration is maintained in a separate collection and consulted when constructing default SecureRandom objects when algorithm isn't supplied. As part of JDK-7092821, this separate collection is cleaned up as the parent stores the same set of values. The ordering isn't documented anywhere and is not considered part of specification. JDK-8228613 is filed and fixed so that same default SecureRandom algorithm is picked when using SUN provider. As it turns out, quite some 3rd party providers are affected by this default SecureRandom change as a different default algorithm is chosen when they are the most preferred providers, e.g. JDK-8246383. Thus, the default SecureRandom algo should remain the same. However, for long term, it'd be nice to have an official mechanism for providers to indicate which one is the default instead of relying on the ordering which is fragile.
Comments
|