Question

I am getting a random number in My android client as well as Server(Servlet). I am using the same SecureRandom algorithm(“SHA1PRNG”) in both client and server. My seed value is same for both. But the output number I am getting is different in both client as well as Server. What could be the reason for it? Here is my code:

SecureRandom random = new SecureRandom();
try {
    random.getInstance("SHA1PRNG");
} catch (Exception e) {
    // ...
}
;
random.setSeed(1097327);
byte[] b1 = new byte[3];
random.nextBytes(b1);
long value = 0;
for (int i = 0; i < b1.length; i++) {
    value += (b1[i] & 0xff) << (8 * i);
    Toast.makeText(getApplicationContext(), Long.toString(value),
            Toast.LENGTH_LONG).show();
}

Answer 1

The javadoc of SecureRandom says:

Many SecureRandom implementations are in the form of a pseudo-random
number generator (PRNG), which means they use a deterministic
algorithm to produce a pseudo-random sequence from a true random seed.
Other implementations may produce true random numbers, and yet others
may use a combination of both techniques.

Maybe the algorithm uses another randomness source to produce its random numbers. Doing it would not break the contract of the SecureRandom class. It would even satisfy it even more, since the goal of a secure random generator is to produce random numbers, and not a predictable sequence of numbers.