wstrange/GoogleAuth — pull request #7 by emcrisostomo (2014-04-08 16:30:21+00:00)
Title: Drop and recreate a SecureRandom instance after a certain number of calls.

Hi Warren,

How's all going?

I took advantage of today's complaint about slowness on Linux (with the NativePRNG) to review a couple of things which I left undone a while ago:

* First of all, I removed the `generateSeed()` call in the `GoogleAuthenticator` constructor. That method may block until sufficient entropy is gathered and it is anyway useless there.
* Then, I added a tiny wrapper class around the `SecureRandom` class and the `SecureRandom#nextBytes` method. The wrapper forwards calls to `nextBytes` to an internal `SecureRandom` instance which is *discarded* and *recreated* after a certain number of calls. At the moment this is not configurable externally and it's hardcoded to 10^6 calls but I will make it tuneable in the near future. The wrapper is thread-safe, so `GoogleAuthenticator` remains thread-safe.

The other approach for long-term security of the internal `SecureRandom` instance would be adding random material to it using `generateSeed` but as I said that call may block on certain situations. I think dropping and recreating the PRNG instance is both a simple approach and it will prevent users from having any kind of performance problems due to insufficient entropy.

If you want, you can pull these changes into your repo.

Cheers.
-- Enrico