Revert "SecureRandom API Update"

This reverts commit eaa8ea8.

Author: jeremiahjstacey

src/main/java/org/owasp/esapi/reference/DefaultRandomizer.java

@@ -54,12 +54,13 @@ public static Randomizer getInstance() {
     private final Logger logger = ESAPI.getLogger("Randomizer");
 
     private DefaultRandomizer() {
+        String algorithm = ESAPI.securityConfiguration().getRandomAlgorithm();
         try {
-            secureRandom = SecureRandom.getInstanceStrong();
+            secureRandom = SecureRandom.getInstance(algorithm);
         } catch (NoSuchAlgorithmException e) {
             // Can't throw an exception from the constructor, but this will get
             // it logged and tracked
-            new EncryptionException("Error creating randomizer", "Failed to generate strong SecureRandom reference", e);
+            new EncryptionException("Error creating randomizer", "Can't find random algorithm " + algorithm, e);
         }
     }
 

src/main/java/org/owasp/esapi/reference/crypto/JavaEncryptor.java

@@ -205,7 +205,14 @@ public static void main( String[] args ) throws Exception {
             System.out.println( "\tuse '-print' to also show available crypto algorithms from all the security providers" );
         }
 
-        SecureRandom random = SecureRandom.getInstanceStrong();
+        // setup algorithms -- Each of these have defaults if not set, although
+        //                     someone could set them to something invalid. If
+        //                     so a suitable exception will be thrown and displayed.
+        encryptAlgorithm = ESAPI.securityConfiguration().getEncryptionAlgorithm();
+        encryptionKeyLength = ESAPI.securityConfiguration().getEncryptionKeyLength();
+        randomAlgorithm = ESAPI.securityConfiguration().getRandomAlgorithm();
+
+        SecureRandom random = SecureRandom.getInstance(randomAlgorithm);
         SecretKey secretKey = CryptoHelper.generateSecretKey(encryptAlgorithm, encryptionKeyLength);
         byte[] raw = secretKey.getEncoded();
         byte[] salt = new byte[20]; // Or 160-bits; big enough for SHA1, but not SHA-256 or SHA-512.
@@ -273,7 +280,7 @@ private JavaEncryptor() throws EncryptionException {
                 // For asymmetric encryption (i.e., public/private key)
                 //
                 try {
-                    SecureRandom prng = SecureRandom.getInstanceStrong();
+                    SecureRandom prng = SecureRandom.getInstance(randomAlgorithm);
 
                     // Because hash() is not static (but it could be were in not
                     // for the interface method specification in Encryptor), we