tree 206d79ba72287649ddde3042db14f24d7eb64fc4
parent 5d2a7b9cdb52d30f5ab916d706a8c50fac4c2b8e
author Matthew Khouzam <matthew.khouzam@ericsson.com> 1625755641 -0400
committer Matthew Khouzam <matthew.khouzam@ericsson.com> 1627502430 -0400

ctf.core: Use secureRandom for reaper

Using pseudorandom number generators (PRNGs) is security-sensitive.
For example, it has led in the past to the following vulnerabilities:

*    CVE-2013-6386
*    CVE-2006-3419
*    CVE-2008-4102

When software generates predictable values in a context requiring
unpredictability, it may be possible for an attacker to guess the
next value that will be generated, and use this guess to impersonate
another user or access sensitive information.

As the java.util.Random class relies on a pseudorandom number generator,
this class and relating java.lang.Math.random() method should not be
used for security-critical applications or for protecting sensitive
data. In such context, the java.security.SecureRandom class which relies
on a cryptographically strong random number generator (RNG) should
be used in place.

Change-Id: I01b6165186a10f90e378c507b47d341cfa50608c
Signed-off-by: Matthew Khouzam <matthew.khouzam@ericsson.com>
Reviewed-on: https://git.eclipse.org/r/c/tracecompass/org.eclipse.tracecompass/+/182898
Tested-by: Trace Compass Bot <tracecompass-bot@eclipse.org>
Tested-by: Patrick Tasse <patrick.tasse@gmail.com>
Reviewed-by: Patrick Tasse <patrick.tasse@gmail.com>