Instances of java.util.Random are not cryptographically secure

[dhcgn]

Instances of java.util.Random are not cryptographically secure. Consider instead using SecureRandom to get a cryptographically secure pseudo-random number generator for use by security-sensitive applications.

ref-idp-server/idp-crypto/src/main/java/de/gematik/idp/crypto/Nonce.java

Line 20 in 694ebd6

import java.util.Random;

[Arkinator]

Thanks for the headsup.
Currently none of the random sources in the server are hardened. This is deliberate and will be addressed in a later release.

[RStaeber]

java.util.Random is no longer part of the project.