Why is this an issue?
The java.security.SecureRandom class provides a strong random number generator (RNG) appropriate for cryptography. However, seeding it
with a constant or another predictable value will weaken it significantly. In general, it is much safer to rely on the seed provided by the
SecureRandom implementation.
This rule raises an issue when SecureRandom.setSeed() or SecureRandom(byte[]) are called with a seed that is either one
of:
- a constant
- the system time
Noncompliant code example
val sr = SecureRandom()
sr.setSeed(123456L) // Noncompliant
val v = sr.nextInt()
val sr = SecureRandom("abcdefghijklmnop".toByteArray(charset("us-ascii"))) // Noncompliant
val v = sr.nextInt()
Compliant solution
val sr = SecureRandom()
val v = sr.nextInt()
Resources
