[JCLOUDS-1512] Use SecureRandom in Sha512Crypt

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.2
• Fix Version/s: 2.2.0, 2.1.3
• Component/s: jclouds-compute
• Assignee: Andrew Gaul
• Reporter: Colm O hEigeartaigh
• Created: 22/Aug/19 09:12
• Updated: 22/Aug/19 16:20
• Resolved: 22/Aug/19 16:19

Description

Sha512Crypt uses java.util.Random to generate a random salt which is not secure. For reference, the Commons Codec Sha512Crypt implementation uses SecureRandom if a user-specified salt is not supplied:

https://github.com/apache/commons-codec/blob/30e5768186f73552b5f1634a76cf2c12bf26b5bb/src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java#L138

https://github.com/apache/commons-codec/blob/30e5768186f73552b5f1634a76cf2c12bf26b5bb/src/main/java/org/apache/commons/codec/digest/B64.java#L81

 

 

Issue Links

• links to: GitHub Pull Request #42