Google confirms Java and OpenSSL crypto PRNG on Android are broken
Here again I will posit:<p>Secure programs should rely on /dev/urandom, to the exclusion of other CSPRNGs, and should specifically eschew userland CSPRNG engines even when they're seeded from /dev/urandom.<p>This Android bug is another in a line of bugs in userland CSPRNGs, the most famous of which was Debian's OpenSSL CSPRNG bug which gave up everyone's SSH key. CSPRNGs have bugs. When you rely on a userland CSPRNG, you're relying on two single points of failure: the userland CSPRNG and the OS's CSPRNG. Failures of <i>either</i> aren't generally survivable.<p>There are people who are smarter than me (notably 'cperciva) who disagree with me on this, but this is an idea I got from DJB's NACL design paper; it's not my own crazy idea.<p>I got to eat dinner with Dan Bernstein the other day, by the way, and it turns out NACL is pronounced "lasagna".