The DEFAULT and NONCEANDIV SecureRandom implementations now accept java.security.DrbgParameters on Java 9 and later, and DEFAULT is also registered as DRBG.

Author: dghgit

core/src/main/java/org/bouncycastle/crypto/prng/SP800SecureRandom.java

@@ -51,6 +51,18 @@ public String getAlgorithm()
     }
 
     public void nextBytes(byte[] bytes)
+    {
+        nextBytes(bytes, (byte[])null);
+    }
+
+    /**
+     * Generate a user-specified number of random bytes, passing additional input to the DRBG.
+     *
+     * @param bytes the array to be filled in with random bytes.
+     * @param additionalInput optional additional input for the DRBG, may be null (cast a literal null to byte[], as
+     *                        Java 9 and later also have SecureRandom.nextBytes(byte[], SecureRandomParameters)).
+     */
+    public void nextBytes(byte[] bytes, byte[] additionalInput)
     {
         synchronized (this)
         {
@@ -60,10 +72,10 @@ public void nextBytes(byte[] bytes)
             }
 
             // check if a reseed is required...
-            if (drbg.generate(bytes, null, predictionResistant) < 0)
+            if (drbg.generate(bytes, additionalInput, predictionResistant) < 0)
             {
                 drbg.reseed(null);
-                drbg.generate(bytes, null, predictionResistant);
+                drbg.generate(bytes, additionalInput, predictionResistant);
             }
         }
     }

docs/releasenotes.md

@@ -106,6 +106,8 @@ Date: 2026, TBD
 
 - The provider adds ECDHwithSHA256HKDF, ECDHwithSHA384HKDF and ECDHwithSHA512HKDF KeyAgreement algorithms: ECDH followed by HKDF (RFC 5869), the counterparts for elliptic curve keys of the XDHwithSHA\*HKDF agreements used for the RFC 8418 dhSinglePass-stdDH-hkdf schemes. As with those, a UserKeyingMaterialSpec supplies the HKDF info and, optionally, its salt. They are registered by name only; the RFC 8418 scheme object identifiers remain registered to the XDH agreements.
 
+- On Java 9 and later the provider's DEFAULT and NONCEANDIV SecureRandom implementations accept java.security.DrbgParameters: SecureRandom.getInstance() given a DrbgParameters.Instantiation creates a DRBG of its own with the requested security strength (rounded up to 112, 128, 192 or 256 bits, 256 being the default and the maximum), capability and personalization string, nextBytes() takes a DrbgParameters.NextBytes carrying additional input and a request for prediction resistance, reseed() takes a DrbgParameters.Reseed, and getParameters() reports how an instance was instantiated. An instance created without parameters uses the shared DRBG as before. DEFAULT is also registered under the alias DRBG, the name Java 9 gives an SP 800-90A DRBG, so with BC installed ahead of the SUN provider SecureRandom.getInstance("DRBG") returns BC's. Lightweight users gain SP800SecureRandom.nextBytes(byte[], byte[]) for passing additional input to the DRBG.
+
 - TLS: Added CertificateStatusType.getName and getText, and TlsUtils.hasExtension.
 
 ### 2.1.4 Additional Notes

prov/src/main/java/org/bouncycastle/jcajce/provider/drbg/DRBG.java

@@ -118,15 +118,18 @@ public Mappings()
 
         public void configure(ConfigurableProvider provider)
         {
-            provider.addAlgorithm("SecureRandom.DEFAULT", PREFIX + "$Default");
-            provider.addAlgorithm("SecureRandom.NONCEANDIV", PREFIX + "$NonceAndIV");
+            // the DRBGSpis jdk1.9 twin swaps in SPIs that also take java.security.DrbgParameters.
+            provider.addAlgorithm("SecureRandom.DEFAULT", DRBGSpis.defaultSpi());
+            provider.addAlgorithm("SecureRandom.NONCEANDIV", DRBGSpis.nonceAndIVSpi());
+            // the name Java 9 and later give an SP 800-90A DRBG, which is what DEFAULT is.
+            provider.addAlgorithm("Alg.Alias.SecureRandom.DRBG", "DEFAULT");
         }
     }
 
     public static class Default
         extends SecureRandomSpi
     {
-        private static final SecureRandom random = createBaseRandom(true);
+        private static final SP800SecureRandom random = createBaseRandom(true);
 
         public Default()
         {
@@ -151,7 +154,7 @@ protected byte[] engineGenerateSeed(int numBytes)
     public static class NonceAndIV
         extends SecureRandomSpi
     {
-        private static final SecureRandom random = createBaseRandom(false);
+        private static final SP800SecureRandom random = createBaseRandom(false);
 
         public NonceAndIV()
         {
@@ -173,17 +176,47 @@ protected byte[] engineGenerateSeed(int numBytes)
         }
     }
 
-    private static SecureRandom createBaseRandom(boolean isPredictionResistant)
+    /**
+     * The DRBG shared by every DEFAULT SecureRandom created without parameters.
+     */
+    static SP800SecureRandom getDefaultRandom()
+    {
+        return Default.random;
+    }
+
+    /**
+     * The DRBG shared by every NONCEANDIV SecureRandom created without parameters.
+     */
+    static SP800SecureRandom getNonceAndIVRandom()
+    {
+        return NonceAndIV.random;
+    }
+
+    private static SP800SecureRandom createBaseRandom(boolean isDefault)
+    {
+        return createBaseRandom(isDefault, isDefault, 256, null);
+    }
+
+    /**
+     * Create a DRBG from the provider's configured entropy source.
+     *
+     * @param isDefault true for a DEFAULT DRBG, false for a NONCEANDIV one (selects the generated personalization string).
+     * @param isPredictionResistant true if every request should reseed.
+     * @param securityStrength the security strength of the DRBG in bits, at most 256.
+     * @param personalizationString the personalization string, or null to generate one.
+     */
+    static SP800SecureRandom createBaseRandom(boolean isDefault, boolean isPredictionResistant, int securityStrength,
+        byte[] personalizationString)
     {
         if (Properties.getPropertyValue(Properties.DRBG_ENTROPY_SOURCE) != null)
         {
-            return createBaseRandom(isPredictionResistant, 128, createEntropySource());
+            return createBaseRandom(isDefault, isPredictionResistant, securityStrength, personalizationString, 128, createEntropySource());
         }
         else if (Properties.isOverrideSet(Properties.DRBG_ENTROPY_THREAD))
         {
             initEntropyThread();
 
-            return createBaseRandom(isPredictionResistant, 256, new EntropySourceProvider()
+            return createBaseRandom(isDefault, isPredictionResistant, securityStrength, personalizationString, 256, new EntropySourceProvider()
             {
                 public EntropySource get(int bitsRequired)
                 {
@@ -193,7 +226,7 @@ public EntropySource get(int bitsRequired)
         }
         else
         {
-            return createBaseRandom(isPredictionResistant, 256, new EntropySourceProvider()
+            return createBaseRandom(isDefault, isPredictionResistant, securityStrength, personalizationString, 256, new EntropySourceProvider()
             {
                 public EntropySource get(int bitsRequired)
                 {
@@ -203,15 +236,17 @@ public EntropySource get(int bitsRequired)
         }
     }
 
-    private static SecureRandom createBaseRandom(boolean isPredictionResistant, int entropyBits,
-        EntropySourceProvider entropyProvider)
+    private static SP800SecureRandom createBaseRandom(boolean isDefault, boolean isPredictionResistant,
+        int securityStrength, byte[] personalizationString, int entropyBits, EntropySourceProvider entropyProvider)
     {
         EntropySource entropySource = entropyProvider.get(entropyBits);
 
-        byte[] personalisationString = generatePersonalizationString(isPredictionResistant, entropySource);
+        byte[] personalisationString = (personalizationString != null)
+            ? personalizationString : generatePersonalizationString(isDefault, entropySource);
 
         return new SP800SecureRandomBuilder(entropyProvider)
             .setPersonalizationString(personalisationString)
+            .setSecurityStrength(securityStrength)
             .buildHash(new SHA512Digest(), entropySource.getEntropy(), isPredictionResistant);
     }
 
@@ -328,10 +363,10 @@ private static byte[] generateNonceIVPersonalizationString(byte[] seed)
             Pack.longToLittleEndian(Thread.currentThread().getId()), Pack.longToLittleEndian(System.currentTimeMillis()));
     }
 
-    private static byte[] generatePersonalizationString(boolean isPredictionResistant, EntropySource entropySource)
+    private static byte[] generatePersonalizationString(boolean isDefault, EntropySource entropySource)
     {
         byte[] entropy = entropySource.getEntropy();
-        return isPredictionResistant
+        return isDefault
             ? generateDefaultPersonalizationString(entropy)
             : generateNonceIVPersonalizationString(entropy);
     }

prov/src/main/java/org/bouncycastle/jcajce/provider/drbg/DRBGSpis.java

@@ -0,0 +1,24 @@
+package org.bouncycastle.jcajce.provider.drbg;
+
+/**
+ * Multi-release hook naming the SecureRandom SPI classes DRBG.Mappings registers. This base copy
+ * names the plain DRBG SPIs; the jdk1.9 twin names ParameterisedDRBG, whose SPIs also take
+ * java.security.DrbgParameters. Keep the method set of the two copies identical. These are methods
+ * rather than constants so the name is resolved against whichever copy the JDK loads.
+ */
+final class DRBGSpis
+{
+    private DRBGSpis()
+    {
+    }
+
+    static String defaultSpi()
+    {
+        return DRBG.class.getName() + "$Default";
+    }
+
+    static String nonceAndIVSpi()
+    {
+        return DRBG.class.getName() + "$NonceAndIV";
+    }
+}

prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java

@@ -297,7 +297,17 @@ public Service run()
                             {
                                 return null;
                             }
+                            // swap each service once: one reached through an alias and then its own name (or the
+                            // reverse) must not be put again, which on JDK 11 fails for a SecureRandom service.
+                            String canonicalKey = service.getType() + "." + Strings.toUpperCase(service.getAlgorithm());
+                            Service swapped = serviceMap.get(canonicalKey);
+                            if (swapped != null)
+                            {
+                                serviceMap.put(key, swapped);
+                                return swapped;
+                            }
                             serviceMap.put(key, service);
+                            serviceMap.put(canonicalKey, service);
                             // remove legacy entry and swap to service entry
                             BouncyCastleProvider.super.remove(service.getType() + "." + service.getAlgorithm());
                             BouncyCastleProvider.super.putService(service);

prov/src/main/jdk1.9/org/bouncycastle/jcajce/provider/drbg/DRBGSpis.java

@@ -0,0 +1,24 @@
+package org.bouncycastle.jcajce.provider.drbg;
+
+/**
+ * Multi-release hook naming the SecureRandom SPI classes DRBG.Mappings registers. This jdk1.9 copy
+ * names ParameterisedDRBG, whose SPIs also take java.security.DrbgParameters; the base copy names
+ * the plain DRBG SPIs. Keep the method set of the two copies identical. These are methods rather
+ * than constants so the name is resolved against whichever copy the JDK loads.
+ */
+final class DRBGSpis
+{
+    private DRBGSpis()
+    {
+    }
+
+    static String defaultSpi()
+    {
+        return ParameterisedDRBG.class.getName() + "$Default";
+    }
+
+    static String nonceAndIVSpi()
+    {
+        return ParameterisedDRBG.class.getName() + "$NonceAndIV";
+    }
+}