I have not heard that before, please do point at any references if you know of any. If it is true it should not be used, you are right.
In that case rand.nextInt(ARRAY.length) would be the safer bet.
In that case rand.nextInt(ARRAY.length) would be the safer bet.
I don't have a reference, but say you want to map a random value R between 0 and 15 to a value P between 0 and 9 and use P=(R modulo 10):
Code:
R P
0 0
1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
9 9
10 0
11 1
12 2
13 3
14 4
15 5
As you see, having the input value R completely random, doesn't mean that P is as random, since you will get values 0 to 5 twice as often as values 6 to 9.
I picked the example to show the problem. With the very large ranges for R (e.g. integer) and very small ranges for P (e.g. 0 to 8191), the problem might just be a very theoretical one.
think of 1626 words as numbers (base 1626)
1. word1
2. word2
3. word3
.
.
.
1626 word1626
so number 1627 would be equal to word1626word1
You can generate a 128-bit number (totally secure using secure random) and then convert it into words
I don't see how there can be any flaw in that implementation, as the original 128-bit was generated with secure random and it is only represented as words
This would be same as representing a binary number as hex or decimal.
The password made with that implementation can't be any weaker than 128-bit just as converting decimal number to hex doesn't make it weaker
This by the way means only 12 words are needed to convert any 128-bit number into words
.
