My team got handed over some server side code (in Java) that generates random tokens and I have a question regarding the same –
The purpose of these tokens is fairly sensitive – used for session id, password reset links etc. So they do need to be cryptographically random to avoid somebody guessing them or brute force them feasibly. The token is a “long” so it is 64 bits long.
The code currently uses the java.util.Random class to generate these tokens. The documentation for java.util.Random clearly states the following:
Instances of java.util.Random are not cryptographically secure. Consider instead using SecureRandom to get a cryptographically secure pseudo-random number generator for use by security-sensitive applications.
However, the way the code is currently using java.util.Random is this – It instantiates the java.security.SecureRandom class and then uses the SecureRandom.nextLong() method to obtain the seed that is used for instantiating the java.util.Randomclass. Then it uses java.util.Random.nextLong() method to generate the token.
So my question now – Is it still insecure given that the java.util.Random is being seeded using java.security.SecureRandom? Do I need to modify the code so that it uses java.security.SecureRandom exclusively to generate the tokens?
Currently the code seed’s the Random once at startup
