fta2012 / replicatedrandom Goto Github PK

public class Vulnerability_Weak_Crypto {

    @Test
    public void randomTest()
    {
        ReplicatedRandom rr = new ReplicatedRandom();

        System.out.println("Replicating from nextInt");
        for (int i = 0; i < 3; i++) {
            Random r = new Random();
            if (rr.replicateState(r.nextInt(), r.nextInt())) {
                for (int j = 0; j < 3; j++)
                    System.out.println(rr.nextInt() + "\t" + r.nextInt());
                System.out.println();
            }
        }
    }
}


class ReplicatedRandom extends Random {


    // Replicate the state of a Random using two consecutive values from its nextFloat
    public boolean replicateState(float firstNextFloat, float secondNextFloat) {
        return replicateState((int)(firstNextFloat * (1 << 24)), 24, (int)(secondNextFloat * (1 << 24)), 24);
    }

    public boolean replicateState(int nextN, int n, int nextM, int m) {
        // Constants copied from java.util.Random
        final long multiplier = 0x5DEECE66DL;
        final long addend = 0xBL;
        final long mask = (1L << 48) - 1;

        long upperMOf48Mask = ((1L << m) - 1) << (48 - m);

        // next(x) is generated by taking the upper x bits of 48 bits of (oldSeed * multiplier + addend) mod (mask + 1)
        // So now we have the upper n and m bits of two consecutive calls of next(n) and next(m)
        long oldSeedUpperN = ((long)nextN << (48 - n)) & mask;
        long newSeedUpperM = ((long)nextM << (48 - m)) & mask;

        // Bruteforce the lower (48 - n) bits of the oldSeed that was truncated.
        // Calculate the next seed for each guess of oldSeed and check if it has the same top m bits as our newSeed.
        // If it does then the guess is right and we can add that to our candidate seeds.
        ArrayList<Long> possibleSeeds = new ArrayList<Long>();
        for (long oldSeed = oldSeedUpperN; oldSeed <= (oldSeedUpperN | ((1L << (48 - n)) - 1)); oldSeed++) {
            long newSeed = (oldSeed * multiplier + addend) & mask;
            if ((newSeed & upperMOf48Mask) == newSeedUpperM) {
                possibleSeeds.add(newSeed);
            }
        }

        if (possibleSeeds.size() == 1) {
            // If there's only one candidate seed, then we found it!
            System.out.println("found seed: " + possibleSeeds.get(0));
            setSeed(possibleSeeds.get(0) ^ multiplier); // setSeed(x) sets seed to `(x ^ multiplier) & mask`, so we need another `^ multiplier` to cancel it out
            return true;
        }
        if (possibleSeeds.size() >= 1) {
            System.out.println("Didn't find a unique seed. Possible seeds were: " + possibleSeeds);
            return false;

        } else {
            System.out.println("Failed to find seed!");
        }
        return false;
    }
}