Generating random IV for AES in Java

Question

I'm implementing and AES encryption engine for PBE in android, and I've found two ways to implement the creation of the IV and I would like to know which one is better and more secure for getting IvParameterSpec:

Method #1:

SecureRandom randomSecureRandom = SecureRandom.getInstance("SHA1PRNG");
byte[] iv = new byte[cipher.getBlockSize()];
randomSecureRandom.nextBytes(iv);

IvParameterSpec ivParams = new IvParameterSpec(iv);

Method #2:

AlgorithmParameters params = cipher.getParameters();
byte[] iv2 = params.getParameterSpec(IvParameterSpec.class).getIV();

ivParams = new IvParameterSpec(iv2);

Spears

Answer 1

I'd use method #1, because the Java API specifies the following for the Cipher.init() API that just takes the encryption/decryption mode and key:

If this cipher instance needs any algorithm parameters or random values that the specified key can not provide, the underlying implementation of this cipher is supposed to generate the required parameters (using its provider or random values).

(emphasis mine).

So it is not clear what different providers will do when method 2 is chosen. Looking at the Android source code, it seems that at least some versions (including version 21?) will not create a random IV - the random IV creation seems commented out.

Method 1 is also more transparent and it is - in my opinion - easier on the eyes.

---

Note that it is generally better to use new SecureRandom() and let the system figure out which RNG is best. "SHA1PRNG" is not well defined, may differ across implementations and is known to have had implementation weaknesses, especially on Android.

---

So the end result should be something like:

SecureRandom randomSecureRandom = new SecureRandom();
byte[] iv = new byte[cipher.getBlockSize()];
randomSecureRandom.nextBytes(iv);
IvParameterSpec ivParams = new IvParameterSpec(iv);

---

Beware that GCM mode works best with a 12 byte IV instead of the 16 byte IV - the block size of AES.

Fervidor

Does this answer need an update for Java 8. – Koziel

@Koziel Not really; using the default RNG should be fine. Or did you mean something else? By the way, later versions of Java even have NIST DRBG implementations, so there is more to chose from, and I would consider those more secure. But even then, choosing the default one should be fine, especially if we're just talking about the IV. – Fervidor

No, just talking about a general update of the choices. Yes, For IV that should be enough. – Koziel