SecureRandom漏锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷猓–VE-2013-7372锟斤拷

锟斤拷源锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷|锟斤拷时锟戒：2015-03-12 16:08:10 |锟斤拷锟侥讹拷锟斤拷120锟斤拷|锟斤拷锟斤拷签锟斤拷漏锟斤拷远锟教癸拷锟斤拷锟斤拷锟界安全锟斤拷 |锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷

锟斤拷锟斤拷SecureRandom API锟斤拷锟斤拷锟斤拷锟侥硷拷位锟斤拷$JAVA_HOME/jre/lib/security/java.security锟斤拷锟斤拷锟斤拷锟斤拷锟角匡拷锟斤拷锟斤拷锟矫革拷锟侥硷拷锟斤拷锟絪ecurerandom.source锟斤拷锟斤拷锟斤拷指锟斤拷SecureRandom锟斤拷使锟矫碉拷seed锟斤拷锟斤拷源锟斤拷锟斤拷锟斤拷使锟斤拷锟借备锟斤拷氐锟皆达拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷茫锟�

securerandom.source=file:/dev/urandom securerandom.source=file:/dev/random

锟斤拷锟斤拷SecureRandom锟斤拷锟藉技锟斤拷细锟节ｏ拷锟缴参匡拷锟侥猴拷慰锟斤拷锟斤拷锟�2锟斤拷

锟斤拷锟斤拷锟截点看锟斤拷SecureRandomSpi锟斤拷锟斤拷锟洁，锟侥硷拷锟斤拷锟斤拷锟斤拷3锟斤拷锟矫筹拷锟斤拷锟斤拷为SecureRandom锟洁定锟斤拷锟剿癸拷锟杰接匡拷,锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟襟方凤拷engineSetSeed,engineGenerateSeed,and engineNextBytes锟斤拷锟斤拷锟絊ervice Provider希锟斤拷实锟街硷拷锟斤拷强锟饺较高碉拷伪锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷捅锟斤拷锟绞碉拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟�

然锟斤拷Apache Harmony 6.0M3锟斤拷锟斤拷之前锟芥本锟斤拷SecureRandom实锟斤拷锟斤拷engineNextBytes锟斤拷锟斤拷锟斤拷锟节帮拷全漏锟斤拷锟斤拷

0锟斤拷03 Apache Harmony锟斤拷s SecureRandom实锟斤拷

Apache Harmony 锟斤拷2005锟斤拷锟斤拷Apache License锟斤拷锟斤拷锟斤拷一锟斤拷锟斤拷源锟斤拷java锟斤拷锟侥库。锟斤拷然2011锟斤拷锟皆猴拷锟斤拷锟斤拷锟斤拷停锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟侥匡拷锟轿狦oogle Android platform锟斤拷一锟斤拷锟街硷拷锟斤拷锟斤拷锟斤拷锟斤拷维锟斤拷锟斤拷

Apache Harmony's SecureRandom实锟斤拷锟姐法锟斤拷锟铰ｏ拷

SecureRandom漏洞技术分析详解（CVE-2013-7372）

Android锟斤拷锟絇RNG使锟斤拷SHA-1锟斤拷希锟姐法锟斤拷锟缴诧拷锟斤拷系统锟结供锟斤拷锟借备锟斤拷氐锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟轿憋拷锟斤拷锟斤拷锟叫★拷锟斤拷锟斤拷锟斤拷锟酵拷锟斤拷锟斤拷锟斤拷锟�(锟斤拷seed+counter+ padding)锟斤拷锟斤拷锟斤拷希锟斤拷图锟斤拷锟斤拷锟斤拷锟侥★拷锟姐法锟斤拷锟斤拷图

SecureRandom漏洞技术分析详解（CVE-2013-7372）

锟斤拷锟叫硷拷锟斤拷锟斤拷counter锟斤拷0锟斤拷始锟斤拷锟姐法每锟斤拷锟斤拷一锟斤拷锟斤拷锟斤拷一锟斤拷counter锟斤拷padding锟斤拷锟街讹拷锟斤拷锟皆筹拷为buffer锟斤拷Padding锟斤拷锟斤拷SHA-1锟斤拷锟斤拷锟斤拷式锟斤拷锟斤拷锟斤拷8 byte锟斤拷锟揭猦ash锟斤拷值锟侥筹拷锟斤拷len锟斤拷剩锟铰的诧拷锟斤拷锟斤拷一锟斤拷1锟斤拷锟斤拷锟斤拷锟�0锟侥革拷式锟斤拷锟斤拷锟斤拷洹ｏ拷锟襟返伙拷Hash锟斤拷慕锟斤拷锟斤拷也锟斤拷锟斤拷锟斤拷锟缴碉拷伪锟斤拷锟斤拷锟斤拷小锟�

0锟斤拷04 Apache Harmony锟斤拷s SecureRandom漏锟斤拷细锟斤拷

锟斤拷使锟斤拷锟睫参癸拷锟届函锟斤拷锟斤拷锟斤拷一锟斤拷SecureRandom实锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟揭诧拷锟绞癸拷锟絪etSeed()锟斤拷锟叫筹拷始锟斤拷时,锟斤拷锟斤拷一锟斤拷锟斤拷始值锟襟，达拷锟诫不锟斤拷锟斤拷确锟侥碉拷锟斤拷偏锟斤拷锟斤拷(byte offset,锟斤拷锟給ffset锟斤拷指锟斤拷state buffer锟斤拷指锟斤拷)锟斤拷锟解导锟铰憋拷锟矫革拷锟斤拷锟斤拷锟斤拷锟接猴拷锟斤拷募锟斤拷锟斤拷锟�(8 byte)锟斤拷padding(锟斤拷始4 byte)锟斤拷锟斤拷锟斤拷锟斤拷锟接碉拷锟斤拷始12 byte锟斤拷锟截碉拷剩锟斤拷8 byte(20 byte锟斤拷锟斤拷锟斤拷锟斤拷未锟斤拷锟斤拷锟角诧拷锟斤拷),使锟斤拷PRNG锟斤拷锟斤拷应锟斤拷锟斤拷效锟斤拷

小锟斤拷锟狡硷拷锟侥讹拷