Provide fallback SecureRandom in low-level KEM generators

peterdettman · peterdettman · commit eb7d9171f1e6 · 2026-02-10T18:10:14.000+07:00
diff --git a/core/src/main/java/org/bouncycastle/pqc/crypto/hqc/HQCKEMGenerator.java b/core/src/main/java/org/bouncycastle/pqc/crypto/hqc/HQCKEMGenerator.java
@@ -2,6 +2,7 @@
 
 import java.security.SecureRandom;
 
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.EncapsulatedSecretGenerator;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
@@ -11,11 +12,11 @@
 public class HQCKEMGenerator
     implements EncapsulatedSecretGenerator
 {
-    private final SecureRandom sr;
+    private final SecureRandom random;
 
     public HQCKEMGenerator(SecureRandom random)
     {
-        this.sr = random;
+        this.random = CryptoServicesRegistrar.getSecureRandom(random);
     }
 
     public SecretWithEncapsulation generateEncapsulated(AsymmetricKeyParameter recipientKey)
@@ -29,7 +30,7 @@ public SecretWithEncapsulation generateEncapsulated(AsymmetricKeyParameter recip
         byte[] salt = new byte[key.getParameters().getSALT_SIZE_BYTES()];
         byte[] pk = key.getPublicKey();
 
-        engine.encaps(u, v, K, pk, salt, sr);
+        engine.encaps(u, v, K, pk, salt, random);
 
         byte[] cipherText = Arrays.concatenate(u, v, salt);
 
diff --git a/core/src/main/java/org/bouncycastle/pqc/crypto/ntru/NTRUKEMGenerator.java b/core/src/main/java/org/bouncycastle/pqc/crypto/ntru/NTRUKEMGenerator.java
@@ -2,6 +2,7 @@
 
 import java.security.SecureRandom;
 
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.EncapsulatedSecretGenerator;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.digests.SHA3Digest;
@@ -22,19 +23,9 @@ public class NTRUKEMGenerator
 {
     private final SecureRandom random;
 
-    /**
-     * Constructor
-     *
-     * @param random a secure random number generator
-     */
     public NTRUKEMGenerator(SecureRandom random)
     {
-        if (random == null)
-        {
-            throw new NullPointerException("'random' cannot be null");
-        }
-
-        this.random = random;
+        this.random = CryptoServicesRegistrar.getSecureRandom(random);
     }
 
     public SecretWithEncapsulation generateEncapsulated(AsymmetricKeyParameter recipientKey)
diff --git a/core/src/main/java/org/bouncycastle/pqc/crypto/ntruprime/SNTRUPrimeKEMGenerator.java b/core/src/main/java/org/bouncycastle/pqc/crypto/ntruprime/SNTRUPrimeKEMGenerator.java
@@ -2,6 +2,7 @@
 
 import java.security.SecureRandom;
 
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.EncapsulatedSecretGenerator;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
@@ -15,7 +16,7 @@ public class SNTRUPrimeKEMGenerator
 
     public SNTRUPrimeKEMGenerator(SecureRandom random)
     {
-        this.random = random;
+        this.random = CryptoServicesRegistrar.getSecureRandom(random);
     }
 
     @Override
diff --git a/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/hqc/HQCCipherSpi.java b/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/hqc/HQCCipherSpi.java
@@ -19,7 +19,6 @@
 import javax.crypto.spec.SecretKeySpec;
 import javax.security.auth.DestroyFailedException;
 
-import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.InvalidCipherTextException;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.Wrapper;
@@ -154,7 +153,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             if (key instanceof BCHQCPublicKey)
             {
                 wrapKey = (BCHQCPublicKey)key;
-                kemGen = new HQCKEMGenerator(CryptoServicesRegistrar.getSecureRandom(random));
+                kemGen = new HQCKEMGenerator(random);
             }
             else
             {
diff --git a/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/ntru/NTRUCipherSpi.java b/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/ntru/NTRUCipherSpi.java
@@ -19,7 +19,6 @@
 import javax.crypto.spec.SecretKeySpec;
 import javax.security.auth.DestroyFailedException;
 
-import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.InvalidCipherTextException;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.Wrapper;
@@ -145,7 +144,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             if (key instanceof BCNTRUPublicKey)
             {
                 wrapKey = (BCNTRUPublicKey)key;
-                kemGen = new NTRUKEMGenerator(CryptoServicesRegistrar.getSecureRandom(random));
+                kemGen = new NTRUKEMGenerator(random);
             }
             else
             {
diff --git a/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/ntruprime/SNTRUPrimeCipherSpi.java b/prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/ntruprime/SNTRUPrimeCipherSpi.java
@@ -19,7 +19,6 @@
 import javax.crypto.spec.SecretKeySpec;
 import javax.security.auth.DestroyFailedException;
 
-import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.InvalidCipherTextException;
 import org.bouncycastle.crypto.SecretWithEncapsulation;
 import org.bouncycastle.crypto.Wrapper;
@@ -144,7 +143,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             if (key instanceof BCSNTRUPrimePublicKey)
             {
                 wrapKey = (BCSNTRUPrimePublicKey)key;
-                kemGen = new SNTRUPrimeKEMGenerator(CryptoServicesRegistrar.getSecureRandom(random));
+                kemGen = new SNTRUPrimeKEMGenerator(random);
             }
             else
             {
diff --git a/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/hqc/HQCKEMSpi.java b/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/hqc/HQCKEMSpi.java
@@ -33,10 +33,6 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam
         {
             throw new InvalidAlgorithmParameterException("HQC can only accept KTSParameterSpec");
         }
-        if (secureRandom == null)
-        {
-            secureRandom = new SecureRandom();
-        }
         return new HQCEncapsulatorSpi((BCHQCPublicKey)publicKey, (KTSParameterSpec)spec, secureRandom);
     }
 
diff --git a/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/ntru/NTRUKEMSpi.java b/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/ntru/NTRUKEMSpi.java
@@ -33,10 +33,6 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam
         {
             throw new InvalidAlgorithmParameterException("NTRU can only accept KTSParameterSpec");
         }
-        if (secureRandom == null)
-        {
-            secureRandom = new SecureRandom();
-        }
         return new NTRUEncapsulatorSpi((BCNTRUPublicKey) publicKey, (KTSParameterSpec) spec, secureRandom);
     }
 
diff --git a/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/ntruprime/SNTRUPrimeKEMSpi.java b/prov/src/main/jdk17/org/bouncycastle/pqc/jcajce/provider/ntruprime/SNTRUPrimeKEMSpi.java
@@ -30,10 +30,6 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam
         {
             throw new InvalidAlgorithmParameterException("SNTRUPrime can only accept KTSParameterSpec");
         }
-        if (secureRandom == null)
-        {
-            secureRandom = new SecureRandom();
-        }
         return new SNTRUPrimeEncapsulatorSpi((BCSNTRUPrimePublicKey) publicKey,(KTSParameterSpec) spec, secureRandom);
     }
 

Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,7 @@`
`2`	`2`
`3`	`3`	`import java.security.SecureRandom;`
`4`	`4`
	`5`	`+import org.bouncycastle.crypto.CryptoServicesRegistrar;`
`5`	`6`	`import org.bouncycastle.crypto.EncapsulatedSecretGenerator;`
`6`	`7`	`import org.bouncycastle.crypto.SecretWithEncapsulation;`
`7`	`8`	`import org.bouncycastle.crypto.params.AsymmetricKeyParameter;`
`@@ -15,7 +16,7 @@ public class SNTRUPrimeKEMGenerator`
`15`	`16`
`16`	`17`	`public SNTRUPrimeKEMGenerator(SecureRandom random)`
`17`	`18`	`{`
`18`		`- this.random = random;`
	`19`	`+ this.random = CryptoServicesRegistrar.getSecureRandom(random);`
`19`	`20`	`}`
`20`	`21`
`21`	`22`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,6 @@`
`19`	`19`	`import javax.crypto.spec.SecretKeySpec;`
`20`	`20`	`import javax.security.auth.DestroyFailedException;`
`21`	`21`
`22`		`-import org.bouncycastle.crypto.CryptoServicesRegistrar;`
`23`	`22`	`import org.bouncycastle.crypto.InvalidCipherTextException;`
`24`	`23`	`import org.bouncycastle.crypto.SecretWithEncapsulation;`
`25`	`24`	`import org.bouncycastle.crypto.Wrapper;`
`@@ -154,7 +153,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,`
`154`	`153`	`if (key instanceof BCHQCPublicKey)`
`155`	`154`	`{`
`156`	`155`	`wrapKey = (BCHQCPublicKey)key;`
`157`		`- kemGen = new HQCKEMGenerator(CryptoServicesRegistrar.getSecureRandom(random));`
	`156`	`+ kemGen = new HQCKEMGenerator(random);`
`158`	`157`	`}`
`159`	`158`	`else`
`160`	`159`	`{`
Original file line number	Diff line number	Diff line change
`@@ -33,10 +33,6 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam`
`33`	`33`	`{`
`34`	`34`	`throw new InvalidAlgorithmParameterException("HQC can only accept KTSParameterSpec");`
`35`	`35`	`}`
`36`		`- if (secureRandom == null)`
`37`		`- {`
`38`		`- secureRandom = new SecureRandom();`
`39`		`- }`
`40`	`36`	`return new HQCEncapsulatorSpi((BCHQCPublicKey)publicKey, (KTSParameterSpec)spec, secureRandom);`
`41`	`37`	`}`
`42`	`38`
Original file line number	Diff line number	Diff line change
`@@ -30,10 +30,6 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam`
`30`	`30`	`{`
`31`	`31`	`throw new InvalidAlgorithmParameterException("SNTRUPrime can only accept KTSParameterSpec");`
`32`	`32`	`}`
`33`		`- if (secureRandom == null)`
`34`		`- {`
`35`		`- secureRandom = new SecureRandom();`
`36`		`- }`
`37`	`33`	`return new SNTRUPrimeEncapsulatorSpi((BCSNTRUPrimePublicKey) publicKey,(KTSParameterSpec) spec, secureRandom);`
`38`	`34`	`}`
`39`	`35`