vanitasvitae/Smack
1
0
Fork 0
mirror of https://github.com/vanitasvitae/Smack.git synced 2025-09-09 00:59:39 +02:00
Code Issues Releases Wiki Activity

Add secure(OnlineAttackSafe|Unique|OfflineAttackSafe)RandomString()

Browse source 
and replace usages of java.util.UUID in Smack with
secureUniqueRandomString() because it uses a thread-local secure random
number generator.
This commit is contained in:
Florian Schmaus 2019-06-02 19:56:56 +02:00
parent 58fc39714f
commit 619b8e6f4a
8 changed files with 89 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

23
smack-openpgp/src/main/java/org/jivesoftware/smackx/ox/util/SecretKeyBackupHelper.java
View file

@ -18,9 +18,9 @@ package org.jivesoftware.smackx.ox.util;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.Set;
import org.jivesoftware.smack.util.StringUtils;
import org.jivesoftware.smack.util.stringencoder.Base64;
import org.jivesoftware.smackx.ox.crypto.OpenPgpProvider;
@ -52,26 +52,7 @@ public class SecretKeyBackupHelper {
* @return backup code
*/
public static String generateBackupPassword() {
final String alphabet = "123456789ABCDEFGHIJKLMNPQRSTUVWXYZ";
final int len = alphabet.length();
SecureRandom random = new SecureRandom();
StringBuilder code = new StringBuilder(29);
// 6 blocks
for (int i = 0; i < 6; i++) {
// of 4 chars
for (int j = 0; j < 4; j++) {
char c = alphabet.charAt(random.nextInt(len));
code.append(c);
}
// dash after every block except the last one
if (i != 5) {
code.append('-');
}
}
return code.toString();
return StringUtils.secureOfflineAttackSafeRandomString();
}
/**