Android Chromoting: Initialize SecureRandom generator.

remoting/android/java/src/org/chromium/chromoting/SecureRandomInitializer.java

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chromoting;

[palmer, 2014/08/18 17:47:52]

Is there some more general place we can put this so that all the code can use
it?

[Lambros, 2014/08/18 20:31:31]

Probably base/android, to be accessible to our app. We don't use content/ or
chrome/. We do use net/ and ui/ but this code probably doesn't belong there.

+
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.SecureRandom;
+
+/**
+ * This class contains code to initialize a SecureRandom generator securely on Android platforms
+ * <= 4.3. See
+ * {@link http://android-developers.blogspot.com/2013/08/some-securerandom-thoughts.html}.
+ */
+public class SecureRandomInitializer {
+    private static final int NUM_RANDOM_BYTES = 16;
+
+    /**
+     * Safely initializes the random number generator, by seeding it with data from /dev/urandom.
+     */
+    public static void initialize(SecureRandom generator) throws IOException {
+        FileInputStream fis = null;

[palmer, 2014/08/18 17:47:52]

Nit: Reference types are always initialized to null by default.

[Lambros, 2014/08/18 20:31:31]

Acknowledged.

+        try {
+            fis = new FileInputStream("/dev/urandom");
+            byte[] bytes = new byte[NUM_RANDOM_BYTES];

[palmer, 2014/08/18 17:47:52]

Nit: You could optimize a bit by making the array be a field in this class,
rather than allocating on each call.

[Lambros, 2014/08/18 20:31:31]

Acknowledged.

+            if (bytes.length != fis.read(bytes)) {
+                throw new IOException("Failed to get enough random data.");
+            }
+            generator.setSeed(bytes);
+        } finally {
+            try {
+                if (fis != null) {
+                    fis.close();
+                }
+            } catch (IOException e) {
+                // Ignore exception closing the device.
+            }
+        }
+    }
+}