Should I seed a SecureRandom?

Question

Found the following code in our code base:

public static final int DEFAULT_LENGTH = 16;
private static SecureRandom SR;
static
{
   try
   {
      SecureRand         


        

Answer 1

Sad, that javadoc does not say, what the minimum seed size "DEFAULT_LENGTH" is to reach the intended security level of algorithm design, not even for some default implementation. :(

Essentially security depends on true random; there is nothing like "an algorithm seeding itself without exterior data". Unless the inputs of a seed generator are revealed, it is not possible to certify any security level.

Providers of true random are 1.) https://www.random.org/ 2.) Tools as VeraCrypt derive white noise from mouse motion.

If your goal is real security, you will combine numbers from anonymous random generators with self-cerified white noise.