Randomly Failed! The State of Randomness in Current Java Implementations

This paper investigates the Randomness of several Java Runtime Libraries by inspecting the integrated Pseudo Random Number Generators. Significant weaknesses in different libraries including Android, are uncovered.

[1]  Silvio Micali,et al.  How to construct random functions , 1986, JACM.

[2]  Bruce Schneier,et al.  Cryptanalytic Attacks on Pseudorandom Number Generators , 1998, FSE.

[3]  Elaine B. Barker,et al.  A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications , 2000 .

[4]  Matthew J. B. Robshaw,et al.  Analysis of SHA-1 in Encryption Mode , 2001, CT-RSA.

[5]  David Naccache,et al.  Topics in Cryptology — CT-RSA 2001 , 2001, Lecture Notes in Computer Science.

[6]  Gerhard Goos,et al.  Fast Software Encryption , 2001, Lecture Notes in Computer Science.

[7]  Bartosz Zoltak,et al.  VMPC One-Way Function and Stream Cipher , 2004, FSE.

[8]  T. Suzaki,et al.  The Most Efficient Distinguishing Attack on VMPC and RC 4 A , 2005 .

[9]  Alexander Maximov.  Two Linear Distinguishing Attacks on VMPC and RC4A and Weakness of RC4 Family of Stream Ciphers , 2005, FSE.

[10]  Benny Pinkas,et al.  Analysis of the Linux random number generator , 2006, 2006 IEEE Symposium on Security and Privacy (S&P'06).

[11]  Benny Pinkas,et al.  Cryptanalysis of the windows random number generator , 2007, CCS '07.

[12]  Kyoung-Rok Cho,et al.  Implementation of high-speed SHA-1 architecture , 2009, IEICE Electron. Express.

[13]  Werner Schindler,et al.  Random Number Generators for Cryptographic Applications , 2009, Cryptographic Engineering.

[14]  Josef Pieprzyk,et al.  Differential Path for SHA-1 with complexity O(252) , 2009, IACR Cryptol. ePrint Arch..

[15]  Arjen K. Lenstra,et al.  Public Keys , 2012, CRYPTO.

[16]  Eric Wustrow,et al.  Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices , 2012, USENIX Security Symposium.

[17]  Aggelos Kiayias,et al.  I Forgot Your Password: Randomness Attacks Against PHP Applications , 2012, USENIX Security Symposium.

[18]  Ran Canetti,et al.  Advances in Cryptology – CRYPTO 2012 , 2012, Lecture Notes in Computer Science.