RandomCookie problem ?

[Xuelei Fan]

On 12/13/2016 8:46 AM, Thomas Lußnig wrote:
> Hi,
>
> even if the case is with the current time not active. Is it an good idea
> to define an fixed value
> for random generator under special conditions that are time depending ?
>
The issue was fixed in JDK 9:

    https://bugs.openjdk.java.net/browse/JDK-8046294

Thanks,
Xuelei

> Gruß Thomas
>
> ---
>
> package sun.security.ssl;
>
>     RandomCookie(final SecureRandom sr) {
>         final long ts0 = System.currentTimeMillis() / 1000L;
>         int ts1;
>         if(ts0 < Integer.MAX_VALUE) { ts1 = (int)ts0        ; }
>         else                       *{ ts1 = Integer.MAX_VALUE; }*
>         this.random_bytes = new byte[32];
>         sr.nextBytes(this.random_bytes);
>         this.random_bytes[0] = (byte)(ts1 >> 24);
>         this.random_bytes[1] = (byte)(ts1 >> 16);
>         this.random_bytes[2] = (byte)(ts1 >> 8);
>         this.random_bytes[3] = (byte) ts1;
>     }