java spring BCryptPasswordEncoder "SecureRandom random" constructor parameter

Question

Can you please explain what means SecureRandom random parameter in class org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder?

Javadoc is here: javadoc

And I ask about this constructor: BCryptPasswordEncoder(int strength, SecureRandom random). I can't understand what parameter SecureRandom random means.

I've tried to read spring documentation or find something in google, but I still don't understand it's purpose. I know that bCrypt always add some random salt to password, but as I see from the sources of BCrypt class, it is not the same.

It is random number generator and spring security allows this in contructor because you can specify custom configuration for random number for this. refer this docs.oracle.com/javase/7/docs/api/java/security/… — Jekin Kalariya
– Jekin Kalariya, Commented Sep 10, 2016 at 17:41

Kent Bull · Accepted Answer · 2016-09-10 18:21:46Z

Just as it says from the javadoc for SecureRandom it is an object containing a random number that you can use to randomize the hashes that the BCryptPasswordEncoder generates.

Here is what the javadoc for the class states:

A cryptographically strong random number minimally complies with the statistical random number generator tests specified in FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1.

For an example of how to create a SecureRandom here is another quote from the documentation:

Typical callers of SecureRandom invoke the following methods to retrieve random bytes:

  SecureRandom random = new SecureRandom();
  byte bytes[] = new byte[20];
  random.nextBytes(bytes);

Callers may also invoke the generateSeed method to generate a given number of seed bytes (to seed other random number generators, for example):

  byte seed[] = random.generateSeed(20);

Shehan Simen · Accepted Answer · 2021-10-27 01:40:04Z

0

Define the bean as follows (strength 11 and SecureRandom as salt)

@Bean
public PasswordEncoder encoder() {
    return new BCryptPasswordEncoder(11, new SecureRandom());
}

answered Oct 27, 2021 at 1:40

Shehan Simen

1,3562 gold badges18 silver badges33 bronze badges

Collectives™ on Stack Overflow

java spring BCryptPasswordEncoder "SecureRandom random" constructor parameter

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related