From 3c85b8691550765604f5c4de5adac6fc1140d03d Mon Sep 17 00:00:00 2001 From: Fabian Henneke Date: Tue, 23 Jun 2020 14:51:55 +0200 Subject: [PATCH] Always use JCERandom as the default RNG (#606) The current implementation relies on `VMPCRandomGenerator` for random number generation if BouncyCastle is registered, otherwise it falls back to `SecureRandom`. Nowadays, `SecureRandom` should always be the best available option, whereas `VMPCRandomGenerator` [has known weaknesses](https://books.google.de/books?id=niO6BQAAQBAJ&pg=PA140&lpg=PA140&dq=vmpc+prng&source=bl&ots=QAdZJOT607&sig=ACfU3U0Edqlpm08iRZJLxeWGQNwNQz7WsQ&hl=en&sa=X&ved=2ahUKEwjd2Zyr9pfqAhXWMMAKHT70AioQ6AEwDnoECAoQAQ#v=onepage&q=vmpc%20prng&f=false). --- src/main/java/net/schmizz/sshj/DefaultConfig.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/main/java/net/schmizz/sshj/DefaultConfig.java b/src/main/java/net/schmizz/sshj/DefaultConfig.java index c47beb07..ddf79c38 100644 --- a/src/main/java/net/schmizz/sshj/DefaultConfig.java +++ b/src/main/java/net/schmizz/sshj/DefaultConfig.java @@ -146,8 +146,7 @@ public class DefaultConfig } protected void initRandomFactory(boolean bouncyCastleRegistered) { - setRandomFactory(new SingletonRandomFactory(bouncyCastleRegistered - ? new BouncyCastleRandom.Factory() : new JCERandom.Factory())); + setRandomFactory(new SingletonRandomFactory(new JCERandom.Factory())); } protected void initFileKeyProviderFactories(boolean bouncyCastleRegistered) {