4 ms·
So I should write my own cross-platform interface to the system PRNG? Doesn't that strike you as more prone to error than relying on SecureRandom, which at leas
by weavejester 13y ago
So I should write my own cross-platform interface to the system PRNG? Doesn't that strike you as more prone to error than relying on SecureRandom, which at least has the advantage of having many eyes on it.
- tptacek 13y agoNO. Relying on SecureRandom is riskier than writing the 5-10 lines of code it takes to read from urandom. Prefer urandom to SecureRandom. Look what "many eyes" did for the Harmony PRNG.
- weavejester 13y agoAnd urandom is not cross-platform, so if I were going to write a cross-platform library, how would you suggest doing it? By writing an interface to urandom, then an interface to CryptGenRandom (doesn't that require an FFI?), and then manually going through all of the platforms Java can potentially execute on until I can be sure I've covered all my bases? I'm pretty sure that's going to be more than 5-10 lines of code.