SecureRandom.getInstanceStrong() -> new SecureRandom()

Author: chtompki

RELEASE-NOTES.txt

@@ -19,7 +19,6 @@ o Wrong value calculated by Cologne Phonetic if a special character is placed be
 o ColognePhoneticTest.testIsEncodeEquals missing assertions  Issue: CODEC-246. Thanks to Oscar Luis Vera Pérez.
 
 Changes:
-o Update from Java 6 to Java 7  Issue: CODEC-244.
 o Update from Java 7 to Java 8  Issue: CODEC-253.
 
 

pom.xml

@@ -224,8 +224,8 @@ limitations under the License.
     </dependency>
   </dependencies>
   <properties>
-    <maven.compiler.source>1.8</maven.compiler.source>
-    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.7</maven.compiler.source>
+    <maven.compiler.target>1.7</maven.compiler.target>
     <commons.componentid>codec</commons.componentid>
     <commons.module.name>org.apache.commons.codec</commons.module.name>
     <commons.jira.id>CODEC</commons.jira.id>

src/main/java/org/apache/commons/codec/digest/B64.java

@@ -75,11 +75,7 @@ static void b64from24bit(final byte b2, final byte b1, final byte b0, final int
    * @return a random salt {@link String}.
    */
   static String getRandomSalt(final int num) {
-    try {
-      return getRandomSalt(num, SecureRandom.getInstanceStrong());
-    } catch (NoSuchAlgorithmException e) {
-      throw new IllegalStateException(e);
-    }
+    return getRandomSalt(num, new SecureRandom());
   }
 
     /**

src/main/java/org/apache/commons/codec/digest/Md5Crypt.java

@@ -65,8 +65,8 @@ public class Md5Crypt {
     /**
      * See {@link #apr1Crypt(byte[], String)} for details.
      * <p>
-     * A salt is generated for you using {@link ThreadLocalRandom}; for more secure salts consider using
-     * {@link SecureRandom} to generate your own salts and calling {@link #apr1Crypt(byte[], String)}.
+     * A salt is generated for you using {@link SecureRandom}; your own {@link Random} in
+     * {@link #apr1Crypt(byte[], Random)}.
      * </p>
      *
      * @param keyBytes plaintext string to hash.
@@ -98,8 +98,7 @@ public static String apr1Crypt(final byte[] keyBytes, final Random random) {
     /**
      * See {@link #apr1Crypt(String, String)} for details.
      * <p>
-     * A salt is generated for you using {@link ThreadLocalRandom}; for more secure salts consider using
-     * {@link SecureRandom} to generate your own salts.
+     * A salt is generated for you using {@link SecureRandom}
      * </p>
      *
      * @param keyBytes
@@ -207,7 +206,8 @@ public static String md5Crypt(final byte[] keyBytes, final Random random) {
     /**
      * Generates a libc crypt() compatible "$1$" MD5 based hash value.
      * <p>
-     * See {@link Crypt#crypt(String, String)} for details.
+     * See {@link Crypt#crypt(String, String)} for details. We use {@link SecureRandom} for seed generation by
+     * default.
      * </p>
      *
      * @param keyBytes
@@ -229,7 +229,8 @@ public static String md5Crypt(final byte[] keyBytes, final String salt) {
     /**
      * Generates a libc6 crypt() "$1$" or Apache htpasswd "$apr1$" hash value.
      * <p>
-     * See {@link Crypt#crypt(String, String)} or {@link #apr1Crypt(String, String)} for details.
+     * See {@link Crypt#crypt(String, String)} or {@link #apr1Crypt(String, String)} for details. We use
+     * {@link SecureRandom by default}.
      * </p>
      *
      * @param keyBytes

src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java

@@ -100,8 +100,8 @@ public static String sha256Crypt(final byte[] keyBytes) {
      *            plaintext to hash
      * @param salt
      *            real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for
-     *            you using {@link ThreadLocalRandom}; for more secure salts consider using {@link SecureRandom} to
-     *            generate your own salts.
+     *            you using {@link SecureRandom}. If one does not want to use {@link SecureRandom}, you can pass your
+     *            own {@link Random} in {@link #sha256Crypt(byte[], String, Random)}.
      * @return complete hash value including salt
      * @throws IllegalArgumentException
      *             if the salt does not match the allowed pattern
@@ -569,9 +569,10 @@ public static String sha512Crypt(final byte[] keyBytes) {
      * @param keyBytes
      *            plaintext to hash
      * @param salt
-     *            real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for
-     *            you using {@link ThreadLocalRandom}; for more secure salts consider using {@link SecureRandom} to
-     *            generate your own salts.
+     *            real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated
+     *            for you using {@link SecureRandom}; if you want to use a {@link Random} object other than
+     *            {@link SecureRandom} then we suggest you provide it using
+     *            {@link #sha512Crypt(byte[], String, Random)}.
      * @return complete hash value including salt
      * @throws IllegalArgumentException
      *             if the salt does not match the allowed pattern