peterdevpl (Community Member) asked a question.
Hi,
We are using the Apache Commons Lang library and its class called RandomStringUtils to generate random alphanumeric identifiers. As advised by Veracode, we are supplying the java.util.SecureRandom generator, like this:
final SecureRandom random = new SecureRandom();
final String identifier = RandomStringUtils.random(6, 0, 0, true, true, null, random);
Unfortunately Veracode still complains about "insufficient entropy". I analyzed the code of RandomStringUtils and it definitely uses the provided random instance. Even updating to the most recent library version did not help.
AFAIK the default SecureRandom constructor already takes care of providing the most secure algorithm available: https://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html#SecureRandom
Thus I believe my solution is enough and the reported flaw is a false positive. Did I miss anything?
.png){kind=logo}
Hi @peterdevpl (Community Member) ,
Great question!
Veracode Static Analysis reports CWE 331 (Insufficient Entropy) when it detects the usage of a random number generator which does not provide a sufficient amount of entropy. The concern is that if the generated number is actually security-sensitive, an attacker might be able to guess it.
The library you are using (Apache Commons RandomStringUtils) is not supported by us, which is the reason why our engine still flags it. A comprehensive explanation of how to remediate this flaw in Java in a way Veracode supports and recommends can be found here: https://www.veracode.com/blog/research/cryptographically-secure-pseudo-random-number-generator-csprng .
Thank you,
Florian Walter
Hello. I would like to return to this and challenge Veracode's position.
We use exactly the same method in Apache Commons Lang 3 and pass in a SecureRandom()
Looking at the linked blog posts they recommend using SecureRandom. They do not go into how use that randomness to do something real world. That's left to the reader. So we are using a method from a core Apache library to do that.
The other key point about those blog posts is never write your own methods to use random. Always stick to the libraries. That's the entire point of using Apache Commons Lang to make of best practise and not write your own. This isn't some obscure project on GitHub, it's one of the foundations of the language.
So I propose that using the solution above is correct and Veracode not supporting a core Apache library is a problem
Thanks a lot