Question

Would the following code produce a random number with or without bias?

    int numberToGenerate = 20;
    int rangeUpperLimit = 30;
    SecureRandom random = SecureRandom.getInstance("SHA1PRNG");

    for (int i = 0; i < numberToGenerate; i++) {
        int randomInt = random.nextInt(rangeUpperLimit); 
        // Do something with it.
    }        

The values are used to pick chars from a String of length 30, hence the range 0-29. The code to pick the char values is omitted as it is not relevant to the question.

Answer 1

It’s certainly meant to be a uniform distribution (and therefore without bias). From the documentation:

Returns a pseudorandom, uniformly distributed int value between 0 (inclusive) and the specified value (exclusive), drawn from this random number generator’s sequence.

That assumes that the generator sequence is good, but I think that’s a reasonable assumption to make here, especially given the documentation for SecureRandom:

A cryptographically strong random number minimally complies with the statistical random number generator tests specified in FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1.

If you’re concerned about bias, it would be fairly easy to check for any particular run – generate (say) thirty million values, keep track of how many times you get each number, and see how close it is to one million per bucket.