Cleanup: Consolidate initialization of Android's SecureRandom class.

base/android/java/src/org/chromium/base/SecureRandomInitializer.java

Index: base/android/java/src/org/chromium/base/SecureRandomInitializer.java
diff --git a/remoting/android/java/src/org/chromium/chromoting/SecureRandomInitializer.java b/base/android/java/src/org/chromium/base/SecureRandomInitializer.java
similarity index 85%
rename from remoting/android/java/src/org/chromium/chromoting/SecureRandomInitializer.java
rename to base/android/java/src/org/chromium/base/SecureRandomInitializer.java
index cf731ed31054de66a661a015a008c036a8abe013..457e2ef8b913606fc71f3209a7e6ea6e0c95e405 100644
--- a/remoting/android/java/src/org/chromium/chromoting/SecureRandomInitializer.java
+++ b/base/android/java/src/org/chromium/base/SecureRandomInitializer.java
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-package org.chromium.chromoting;
+package org.chromium.base;
 
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -16,6 +16,8 @@ import java.security.SecureRandom;
 public class SecureRandomInitializer {
     private static final int NUM_RANDOM_BYTES = 16;
 
+    private static byte[] sSeedBytes = new byte[NUM_RANDOM_BYTES];

[palmer, 2014/10/06 19:23:46]

I suspect a method-scoped heap array has a greater chance of getting freed,
re-used, and overwritten than a static field.

(Attempts to clear crypto-relevant memory are often cited as "best practice" to
defend against high-capability forensic attackers. I don't personally believe
much that such attacks can be defeated, and even less so in memory-managed
languages. But, if you want to give a nod to such things, leaving the seed bytes
array as a stack-local might be nice. It costs 1 new, of course. So.)

+
     /**
      * Safely initializes the random number generator, by seeding it with data from /dev/urandom.
      */
@@ -23,11 +25,10 @@ public class SecureRandomInitializer {
         FileInputStream fis = null;
         try {
             fis = new FileInputStream("/dev/urandom");
-            byte[] bytes = new byte[NUM_RANDOM_BYTES];
-            if (bytes.length != fis.read(bytes)) {
+            if (fis.read(sSeedBytes) != sSeedBytes.length) {
                 throw new IOException("Failed to get enough random data.");
             }
-            generator.setSeed(bytes);
+            generator.setSeed(sSeedBytes);
         } finally {
             try {
                 if (fis != null) {