/*

 * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package java.security;

import java.util.*;

import java.util.regex.*;

import java.security.Provider.Service;

import sun.security.jca.*;

import sun.security.jca.GetInstance.Instance;

import sun.security.provider.SunEntries;

import sun.security.util.Debug;

/**

 * This class provides a cryptographically strong random number

 * generator (RNG).

 *

 * <p>A cryptographically strong random number minimally complies with the

 * statistical random number generator tests specified in

 * <a href="http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">

 * <i>FIPS 140-2, Security Requirements for Cryptographic Modules</i></a>,

 * section 4.9.1.

 * Additionally, {@code SecureRandom} must produce non-deterministic output.

 * Therefore any seed material passed to a {@code SecureRandom} object must be

 * unpredictable, and all {@code SecureRandom} output sequences must be

 * cryptographically strong, as described in

 * <a href="http://tools.ietf.org/html/rfc4086">

 * <i>RFC 4086: Randomness Requirements for Security</i></a>.

 *

 * <p> Many {@code SecureRandom} implementations are in the form of a

 * pseudo-random number generator (PRNG, also known as deterministic random

 * bits generator or DRBG), which means they use a deterministic algorithm

 * to produce a pseudo-random sequence from a random seed.

 * Other implementations may produce true random numbers,

 * and yet others may use a combination of both techniques.

 *

 * <p>A caller obtains a {@code SecureRandom} instance via the

 * no-argument constructor or one of the {@code getInstance} methods.

 * For example:

 *

 * <blockquote><pre>

 * SecureRandom r1 = new SecureRandom();

 * SecureRandom r2 = SecureRandom.getInstance("NativePRNG");

 * SecureRandom r3 = SecureRandom.getInstance("DRBG",

 *         DrbgParameters.instantiation(128, RESEED_ONLY, null));</pre>

 * </blockquote>

 *

 * <p> The third statement above returns a {@code SecureRandom} object of the

 * specific algorithm supporting the specific instantiate parameters. The

 * implementation's effective instantiated parameters must match this minimum

 * request but is not necessarily the same. For example, even if the request

 * does not require a certain feature, the actual instantiation can provide

 * the feature. An implementation may lazily instantiate a {@code SecureRandom}

 * until it's actually used, but the effective instantiate parameters must be

 * determined right after it's created and {@link #getParameters()} should

 * always return the same result unchanged.

 *

 * <p> Typical callers of {@code SecureRandom} invoke the following methods

 * to retrieve random bytes:

 *

 * <blockquote><pre>

 * SecureRandom random = new SecureRandom();

 * byte[] bytes = new byte[20];

 * random.nextBytes(bytes);</pre>

 * </blockquote>

 *

 * <p> Callers may also invoke the {@link #generateSeed} method

 * to generate a given number of seed bytes (to seed other random number

 * generators, for example):

 *

 * <blockquote><pre>

 * byte[] seed = random.generateSeed(20);</pre>

 * </blockquote>

 *

 * <p> A newly created PRNG {@code SecureRandom} object is not seeded (except

 * if it is created by {@link #SecureRandom(byte[])}). The first call to

 * {@code nextBytes} will force it to seed itself from an implementation-

 * specific entropy source. This self-seeding will not occur if {@code setSeed}

 * was previously called.

 *

 * <p> A {@code SecureRandom} can be reseeded at any time by calling the

 * {@code reseed} or {@code setSeed} method. The {@code reseed} method

 * reads entropy input from its entropy source to reseed itself.

 * The {@code setSeed} method requires the caller to provide the seed.

 *

 * <p> Please note that {@code reseed} may not be supported by all

 * {@code SecureRandom} implementations.

 *

 * <p> Some {@code SecureRandom} implementations may accept a

 * {@link SecureRandomParameters} parameter in its

 * {@link #nextBytes(byte[], SecureRandomParameters)} and

 * {@link #reseed(SecureRandomParameters)} methods to further

 * control the behavior of the methods.

 *

 * <p> Note: Depending on the implementation, the {@code generateSeed},

 * {@code reseed} and {@code nextBytes} methods may block as entropy is being

 * gathered, for example, if the entropy source is /dev/random on various

 * Unix-like operating systems.

 *

 * <h2> Thread safety </h2>

 * {@code SecureRandom} objects are safe for use by multiple concurrent threads.

 *

 * @implSpec

 * A {@code SecureRandom} service provider can advertise that it is thread-safe

 * by setting the <a href=

 * "{@docRoot}/../specs/security/standard-names.html#service-attributes">service

 * provider attribute</a> "ThreadSafe" to "true" when registering the provider.

 * Otherwise, this class will instead synchronize access to the following

 * methods of the {@code SecureRandomSpi} implementation:

 * <ul>

 * <li>{@link SecureRandomSpi#engineSetSeed(byte[])}

 * <li>{@link SecureRandomSpi#engineNextBytes(byte[])}

 * <li>{@link SecureRandomSpi#engineNextBytes(byte[], SecureRandomParameters)}

 * <li>{@link SecureRandomSpi#engineGenerateSeed(int)}

 * <li>{@link SecureRandomSpi#engineReseed(SecureRandomParameters)}

 * </ul>

 *

 * @see java.security.SecureRandomSpi

 * @see java.util.Random

 *

 * @author Benjamin Renaud

 * @author Josh Bloch

 * @since 1.1

 */

public class SecureRandom extends java.util.Random {

    private static final Debug pdebug =

                        Debug.getInstance("provider", "Provider");

    private static final boolean skipDebug =

        Debug.isOn("engine=") && !Debug.isOn("securerandom");

    /**

     * The provider.

     *

     * @serial

     * @since 1.2

     */

    private Provider provider = null;

    /**

     * The provider implementation.

     *

     * @serial

     * @since 1.2

     */

    private SecureRandomSpi secureRandomSpi = null;

    /**

     * Thread safety.

     *

     * @serial

     * @since 9

     */

    private final boolean threadSafe;

    /*

     * The algorithm name of null if unknown.

     *

     * @serial

     * @since 1.5

     */

    private String algorithm;

    // Seed Generator

    private static volatile SecureRandom seedGenerator;

    /**

     * Constructs a secure random number generator (RNG) implementing the

     * default random number algorithm.

     *

     * <p> This constructor traverses the list of registered security Providers,

     * starting with the most preferred Provider.

     * A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the first

     * Provider that supports a {@code SecureRandom} (RNG) algorithm is returned.

     * If none of the Providers support a RNG algorithm,

     * then an implementation-specific default is returned.

     *

     * <p> Note that the list of registered providers may be retrieved via

     * the {@link Security#getProviders() Security.getProviders()} method.

     *

     * <p> See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     */

    public SecureRandom() {

        /*

         * This call to our superclass constructor will result in a call

         * to our own {@code setSeed} method, which will return

         * immediately when it is passed zero.

         */

        super(0);

        getDefaultPRNG(false, null);

        this.threadSafe = getThreadSafe();

    }

    private boolean getThreadSafe() {

        if (provider == null || algorithm == null) {

            return false;

        } else {

            return Boolean.parseBoolean(provider.getProperty(

                    "SecureRandom." + algorithm + " ThreadSafe", "false"));

        }

    }

    /**

     * Constructs a secure random number generator (RNG) implementing the

     * default random number algorithm.

     * The {@code SecureRandom} instance is seeded with the specified seed bytes.

     *

     * <p> This constructor traverses the list of registered security Providers,

     * starting with the most preferred Provider.

     * A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the first

     * Provider that supports a {@code SecureRandom} (RNG) algorithm is returned.

     * If none of the Providers support a RNG algorithm,

     * then an implementation-specific default is returned.

     *

     * <p> Note that the list of registered providers may be retrieved via

     * the {@link Security#getProviders() Security.getProviders()} method.

     *

     * <p> See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     *

     * @param seed the seed.

     */

    public SecureRandom(byte[] seed) {

        super(0);

        getDefaultPRNG(true, seed);

        this.threadSafe = getThreadSafe();

    }

    private void getDefaultPRNG(boolean setSeed, byte[] seed) {

        String prng = getPrngAlgorithm();

        if (prng == null) {

            // bummer, get the SUN implementation

            prng = "SHA1PRNG";

            this.secureRandomSpi = new sun.security.provider.SecureRandom();

            this.provider = Providers.getSunProvider();

            if (setSeed) {

                this.secureRandomSpi.engineSetSeed(seed);

            }

        } else {

            try {

                SecureRandom random = SecureRandom.getInstance(prng);

                this.secureRandomSpi = random.getSecureRandomSpi();

                this.provider = random.getProvider();

                if (setSeed) {

                    this.secureRandomSpi.engineSetSeed(seed);

                }

            } catch (NoSuchAlgorithmException nsae) {

                // never happens, because we made sure the algorithm exists

                throw new RuntimeException(nsae);

            }

        }

        // JDK 1.1 based implementations subclass SecureRandom instead of

        // SecureRandomSpi. They will also go through this code path because

        // they must call a SecureRandom constructor as it is their superclass.

        // If we are dealing with such an implementation, do not set the

        // algorithm value as it would be inaccurate.

        if (getClass() == SecureRandom.class) {

            this.algorithm = prng;

        }

    }

    /**

     * Creates a {@code SecureRandom} object.

     *

     * @param secureRandomSpi the {@code SecureRandom} implementation.

     * @param provider the provider.

     */

    protected SecureRandom(SecureRandomSpi secureRandomSpi,

                           Provider provider) {

        this(secureRandomSpi, provider, null);

    }

    private SecureRandom(SecureRandomSpi secureRandomSpi, Provider provider,

            String algorithm) {

        super(0);

        this.secureRandomSpi = secureRandomSpi;

        this.provider = provider;

        this.algorithm = algorithm;

        this.threadSafe = getThreadSafe();

        if (!skipDebug && pdebug != null) {

            pdebug.println("SecureRandom." + algorithm +

                " algorithm from: " + getProviderName());

        }

    }

    private String getProviderName() {

        return (provider == null) ? "(no provider)" : provider.getName();

    }

    /**

     * Returns a {@code SecureRandom} object that implements the specified

     * Random Number Generator (RNG) algorithm.

     *

     * <p> This method traverses the list of registered security Providers,

     * starting with the most preferred Provider.

     * A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the first

     * Provider that supports the specified algorithm is returned.

     *

     * <p> Note that the list of registered providers may be retrieved via

     * the {@link Security#getProviders() Security.getProviders()} method.

     *

     * @implNote

     * The JDK Reference Implementation additionally uses the

     * {@code jdk.security.provider.preferred}

     * {@link Security#getProperty(String) Security} property to determine

     * the preferred provider order for the specified algorithm. This

     * may be different than the order of providers returned by

     * {@link Security#getProviders() Security.getProviders()}.

     *

     * @param algorithm the name of the RNG algorithm.

     * See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     *

     * @return the new {@code SecureRandom} object

     *

     * @throws NoSuchAlgorithmException if no {@code Provider} supports a

     *         {@code SecureRandomSpi} implementation for the

     *         specified algorithm

     *

     * @throws NullPointerException if {@code algorithm} is {@code null}

     *

     * @see Provider

     *

     * @since 1.2

     */

    public static SecureRandom getInstance(String algorithm)

            throws NoSuchAlgorithmException {

        Objects.requireNonNull(algorithm, "null algorithm name");

        Instance instance = GetInstance.getInstance("SecureRandom",

                SecureRandomSpi.class, algorithm);

        return new SecureRandom((SecureRandomSpi)instance.impl,

                instance.provider, algorithm);

    }

    /**

     * Returns a {@code SecureRandom} object that implements the specified

     * Random Number Generator (RNG) algorithm.

     *

     * <p> A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the specified provider

     * is returned.  The specified provider must be registered

     * in the security provider list.

     *

     * <p> Note that the list of registered providers may be retrieved via

     * the {@link Security#getProviders() Security.getProviders()} method.

     *

     * @param algorithm the name of the RNG algorithm.

     * See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     *

     * @param provider the name of the provider.

     *

     * @return the new {@code SecureRandom} object

     *

     * @throws IllegalArgumentException if the provider name is {@code null}

     *         or empty

     *

     * @throws NoSuchAlgorithmException if a {@code SecureRandomSpi}

     *         implementation for the specified algorithm is not

     *         available from the specified provider

     *

     * @throws NoSuchProviderException if the specified provider is not

     *         registered in the security provider list

     *

     * @throws NullPointerException if {@code algorithm} is {@code null}

     *

     * @see Provider

     *

     * @since 1.2

     */

    public static SecureRandom getInstance(String algorithm, String provider)

            throws NoSuchAlgorithmException, NoSuchProviderException {

        Objects.requireNonNull(algorithm, "null algorithm name");

        Instance instance = GetInstance.getInstance("SecureRandom",

            SecureRandomSpi.class, algorithm, provider);

        return new SecureRandom((SecureRandomSpi)instance.impl,

            instance.provider, algorithm);

    }

    /**

     * Returns a {@code SecureRandom} object that implements the specified

     * Random Number Generator (RNG) algorithm.

     *

     * <p> A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the specified {@code Provider}

     * object is returned.  Note that the specified {@code Provider} object

     * does not have to be registered in the provider list.

     *

     * @param algorithm the name of the RNG algorithm.

     * See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     *

     * @param provider the provider.

     *

     * @return the new {@code SecureRandom} object

     *

     * @throws IllegalArgumentException if the specified provider is

     *         {@code null}

     *

     * @throws NoSuchAlgorithmException if a {@code SecureRandomSpi}

     *         implementation for the specified algorithm is not available

     *         from the specified {@code Provider} object

     *

     * @throws NullPointerException if {@code algorithm} is {@code null}

     *

     * @see Provider

     *

     * @since 1.4

     */

    public static SecureRandom getInstance(String algorithm,

            Provider provider) throws NoSuchAlgorithmException {

        Objects.requireNonNull(algorithm, "null algorithm name");

        Instance instance = GetInstance.getInstance("SecureRandom",

            SecureRandomSpi.class, algorithm, provider);

        return new SecureRandom((SecureRandomSpi)instance.impl,

            instance.provider, algorithm);

    }

    /**

     * Returns a {@code SecureRandom} object that implements the specified

     * Random Number Generator (RNG) algorithm and supports the specified

     * {@code SecureRandomParameters} request.

     *

     * <p> This method traverses the list of registered security Providers,

     * starting with the most preferred Provider.

     * A new {@code SecureRandom} object encapsulating the

     * {@code SecureRandomSpi} implementation from the first

     * Provider that supports the specified algorithm and the specified

     * {@code SecureRandomParameters} is returned.

     *

     * <p> Note that the list of registered providers may be retrieved via

     * the {@link Security#getProviders() Security.getProviders()} method.

     *

     * @implNote

     * The JDK Reference Implementation additionally uses the

     * {@code jdk.security.provider.preferred} property to determine

     * the preferred provider order for the specified algorithm. This

     * may be different than the order of providers returned by

     * {@link Security#getProviders() Security.getProviders()}.

     *

     * @param algorithm the name of the RNG algorithm.

     * See the {@code SecureRandom} section in the <a href=

     * "{@docRoot}/../specs/security/standard-names.html#securerandom-number-generation-algorithms">

     * Java Security Standard Algorithm Names Specification</a>

     * for information about standard RNG algorithm names.

     *

     * @param params the {@code SecureRandomParameters}

     *               the newly created {@code SecureRandom} object must support.

     *

     * @return the new {@code SecureRandom} object

     *

     * @throws IllegalArgumentException if the specified params is

     *         {@code null}

     *

     * @throws NoSuchAlgorithmException if no Provider supports a

     *         {@code SecureRandomSpi} implementation for the specified

     *         algorithm and parameters

     *

     * @throws NullPointerException if {@code algorithm} is {@code null}

     *

     * @see Provider

     *