comment on why the securerandom.getinstancestrong() fallback is neither weaker nor reachable
What the developer wrote
Authored by Craig Raw
comment on why the securerandom.getinstancestrong() fallback is neither weaker nor reachable
What changed, and why it matters
This commit only adds explanatory comments to existing code. It does not change any behavior. The comments clarify that a fallback to a standard SecureRandom is not a security weakness and is practically unreachable in the bundled Java runtime. There is no functional change to how random numbers are generated for wallet seed phrases.
No action required. This is a documentation-only change with no security-relevant functional modification.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch adds inline comments in three Java files and updates a git submodule (drongo). The comments explain that the catch block fallback secureRandom = new SecureRandom() is not weaker than SecureRandom.getInstanceStrong() because both resolve to the SUN provider implementation seeded from the OS CSPRNG, and the catch branch is unreachable because securerandom.strongAlgorithms is configured to DRBG:SUN, which is always present in the bundled runtime. No code logic was altered.
Changed components
MnemonicKeystoreEntryPane.javaMnemonicKeystoreImportPane.javaBip39Dialog.javadrongo submoduleInspect captured patch +7 / −1
### drongo
@@ -1 +1 @@
-Subproject commit 31130261ea12ce6c0836550b6a1653a083f78c38
+Subproject commit 097420f6ea702d0a62f0ba244aeb0a54be06b569
### src/main/java/com/sparrowwallet/sparrow/control/MnemonicKeystoreEntryPane.java
@@ -62,6 +62,8 @@ public void generateNew() {
try {
secureRandom = SecureRandom.getInstanceStrong();
} catch(NoSuchAlgorithmException e) {
+ //Not a fallback to a weaker source: both resolve to the SUN provider and the same java.base implementation seeded from the OS CSPRNG
+ //This branch is in any case unreachable, since securerandom.strongAlgorithms specifies DRBG:SUN, always present in the bundled runtime - see #2040
secureRandom = new SecureRandom();
}
### src/main/java/com/sparrowwallet/sparrow/control/MnemonicKeystoreImportPane.java
@@ -168,6 +168,8 @@ private void generateNew() {
try {
secureRandom = SecureRandom.getInstanceStrong();
} catch(NoSuchAlgorithmException e) {
+ //Not a fallback to a weaker source: both resolve to the SUN provider and the same java.base implementation seeded from the OS CSPRNG
+ //This branch is in any case unreachable, since securerandom.strongAlgorithms specifies DRBG:SUN, always present in the bundled runtime - see #2040
secureRandom = new SecureRandom();
}
### src/main/java/com/sparrowwallet/sparrow/terminal/wallet/Bip39Dialog.java
@@ -112,6 +112,8 @@ private void generateNew() {
try {
secureRandom = SecureRandom.getInstanceStrong();
} catch(NoSuchAlgorithmException e) {
+ //Not a fallback to a weaker source: both resolve to the SUN provider and the same java.base implementation seeded from the OS CSPRNG
+ //This branch is in any case unreachable, since securerandom.strongAlgorithms specifies DRBG:SUN, always present in the bundled runtime - see #2040
secureRandom = new SecureRandom();
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.