Duplicate :
|
ADDITIONAL SYSTEM INFORMATION : Compiler: javac 1.8.0_191 JRE -8 : java version "1.8.0_191" Java(TM) SE Runtime Environment (build 1.8.0_191-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode) JRE-11 : java version "11.0.1" 2018-10-16 LTS Java(TM) SE Runtime Environment 18.9 (build 11.0.1+13-LTS) Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.1+13-LTS, mixed mode) A DESCRIPTION OF THE PROBLEM : java.security.KeyPairGenerator.initialize(int, SecureRandom) don't use the given source of randomness (SecureRandom object). REGRESSION : Last worked in version 8u191 STEPS TO FOLLOW TO REPRODUCE THE PROBLEM : * Compile the given program Using JDK 8 * Run using JRE 8. Prints a non zero value (expected) * Run using JRE 11. Prints zero (not expected) EXPECTED VERSUS ACTUAL BEHAVIOR : EXPECTED - KeyPairGenerator must use the supplied source of randomness . ACTUAL - Under JRE 11 KeyPairGenerator does not use the given source of randomness. Instead it uses the value supplied by sun.security.jca.JCAUtil.getSecureRandom() When sun.security.rsa.RSAKeyPairGenerator.initialize(int , SecureRandom) is delegating to sun.security.rsa.RSAKeyPairGenerator.initialize(AlgorithmParameterSpec params, SecureRandom random) the last parameter is explicitly passed as a null value. From RSAKeyPairGenerator.java: public void initialize(int keySize, SecureRandom random) { try { initialize(new RSAKeyGenParameterSpec(keySize, RSAKeyGenParameterSpec.F4), null); } catch (InvalidAlgorithmParameterException iape) { throw new InvalidParameterException(iape.getMessage()); } } ---------- BEGIN SOURCE ---------- import java.security.KeyPairGenerator; import java.security.SecureRandom; import java.security.SecureRandomSpi; import java.util.concurrent.atomic.AtomicInteger; @SuppressWarnings("null") public class Test { public static void main(String[] args)throws Exception { AtomicInteger usageCount = new AtomicInteger(); SecureRandom delegate = new SecureRandom(); class TestSecureRandomSpi extends SecureRandomSpi { @Override protected void engineSetSeed(byte[] seed) { delegate.setSeed(seed); } @Override protected void engineNextBytes(byte[] bytes) { usageCount.incrementAndGet(); delegate.nextBytes(bytes); } @Override protected byte[] engineGenerateSeed(int numBytes) { usageCount.incrementAndGet(); return delegate.generateSeed(numBytes); } } class TestSecureRandom extends SecureRandom { TestSecureRandom () { super(new TestSecureRandomSpi(), delegate.getProvider()); } } KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); keyPairGenerator.initialize(2048, new TestSecureRandom()); keyPairGenerator.generateKeyPair(); System.out.println(usageCount.get()); } } ---------- END SOURCE ---------- CUSTOMER SUBMITTED WORKAROUND : None. FREQUENCY : always