<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_compose-container" itemscope="" itemtype="https://schema.org/EmailMessage">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span>
<div><span style="">Hello,</span>
<div><span style=""><br>
</span></div>
<div><span style="">yes on Java 8 the keytool will use SHA1PRNG (on Windows) and with Java 9 it will use DRBG(128,reseed_only).</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">I guess both are not well suited for larger permanent keys (like Keytool is supposed to create). But agreed, the Java 9 default is less problematic.</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">Hmm.. thinking out loud. maybe the concept of a strong PRNG does not match well with nonces and personalisation. With the addition of DRBG and the wide variety of parameters, is getInstanceStrong() rather obsolete in 9 or will it be used
by the platform?</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">Instead of trusting Windows CAPI it would be nice to have a DRBG reseeding from it as the default strong secure random. Then it would also be fit for use for key generation.</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">Gruss</span></div>
<div><span style="">Bernd</span></div>
<br>
<div class="x_acompli_signature">Gruss<br>
Bernd<br>
-- <br>
<a dir="ltr" href="http://bernd.eckenfels.net">http://bernd.eckenfels.net</a></div>
<br>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Weijun Wang <weijun.wang@oracle.com><br>
<b>Sent:</b> Friday, March 17, 2017 1:20:29 AM<br>
<b>To:</b> Bernd; security-dev@openjdk.java.net<br>
<b>Subject:</b> Re: Generate Keypairs with strong prng provider (SHA1PRNG)</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">new SecureRandom() should not return SHA1PRNG on JDK 9. If NativePRNG is
<br>
the preferred provider, it will be returned. Otherwise, DRBG will be <br>
used. DRBG is preferred to SHA1PRNG on every platform.<br>
<br>
Thanks<br>
Max<br>
<br>
<br>
On 03/17/2017 07:36 AM, Bernd wrote:<br>
> Hello,<br>
><br>
> as a general precaution I wanted to document key generation best<br>
> practice. The SHA1PRNG with its small state and single 20 byte seed<br>
> always is a bit questionable for generating long term keys. 160 bit<br>
> entropy (as long as the SecureRandom instance is used only once) is not<br>
> enough for larger RSA Keys or AES192 and 256.<br>
><br>
> So I was looking for a solution which works on 8 and 9 and involves more<br>
> seed/state than the SHA1PRNG. On Windows the Windows-PRNG and on Linux<br>
> the NativePRNGs both look better in this regard. The<br>
> SecureRandom.getInstanceStrong() automatially uses them.<br>
><br>
> So while I think in the long run it might be better to wrap those<br>
> generators with DRBG some more I think a minimum is to use the strong<br>
> variant for key generation. I peeked into keytool to see whats best<br>
> practice and I noticed it does unfortunately NOT use the strong variant<br>
> or a DRBG configuration:<br>
><br>
> <a href="http://hg.openjdk.java.net/jdk9/jdk9/jdk/file/c95ebfceb394/src/java.base/share/classes/sun/security/tools/keytool/CertAndKeyGen.java#l150">
http://hg.openjdk.java.net/jdk9/jdk9/jdk/file/c95ebfceb394/src/java.base/share/classes/sun/security/tools/keytool/CertAndKeyGen.java#l150</a><br>
><br>
> Is it really acceptable for long term keys this way? (I guess no answer<br>
> means no :)<br>
><br>
> Would it be possible to bump the security level for keytool in 9?<br>
><br>
> Gruss<br>
> Bernd<br>
><br>
</div>
</span></font>
</body>
</html>