[CRYPTO-160] Package-private class JavaCryptoRandom extends Random but should not

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Assignee: Unassigned
• Reporter: Adrian Anderson
• Created: 02/May/22 17:06
• Updated: 12/Dec/22 22:21
• Resolved: 20/Aug/22 18:55

Description

The CryptoRandom implementation class JavaCryptoRandom extends java.util.Random when they don't need to and without re-implementing the "protected int next(int bits)" method. 
The issue is that if a developer were to use the CryptoRandomFactory to create a JavaCryptoRandom instance and  to Random wanting to use as a replacement for code using an instance of Random in existing code the implementation would fall back to the java.util.Random (inherited) implementation rather than the CryptoRandom (encapsulated) implementation. For example

CryptoRandom cryptoRandom = CryptoRandomFactory.getCryptoRandom(); //instance of JavaCryptoRandom

Random rand = (Random)cryptoRandom;

long randomLong = rand.nextLong(); //returns java.util.Random.nextLong(), circumventing SecureRandom

A simple solution would be to override the "protected int next(int bits)" method within JavaCryptoRandom to invoke the SecureRandom "next(int bits)" implementation.