title: SecureRandom: init once or every time it is needed?
body: <p>Our team is using a SecureRandom to generate a list of key pairs (the SecureRandom is passed to a KeyPairGenerator).  We cannot agree on which of the following two options to use:</p>
  
  <ol>
  <li><p>Create a new instance every time we need to generate a key pair</p></li>
  <li><p>Initialize a static instance and use it for all key pairs</p></li>
  </ol>
  
  <p>Which approach is generally better and <em>why</em>?</p>
  
  <p>ADDED: My gut feeling is that the second option is more secure.  But my only argument is a theoretical attack based on the assumption that the pseudorandomness is derived from the current timestamp: someone may see the creation time of the key pair, guess timestamps in the surrounding time interval, compute the possible pseudorandom sequences, and obtain the key material.</p>
  
  <p>ADDED: My assumption about determinism based on a timestamp was wrong.  That's the difference between Random and SecureRandom.  So, it looks like the answer is: in terms of security it doesn't really matter.</p>