title: What actual algorithm is used by SecureRandom.getInstance("DRBG")?
body: <p>Java 9 (JSR 379) <a href="http://cr.openjdk.java.net/~iris/se/9/java-se-9-pr-spec-01/java-se-9-spec.html#j273" rel="nofollow noreferrer">introduces the NIST DRBG's</a> as specified in <a href="http://openjdk.java.net/jeps/273" rel="nofollow noreferrer">JEP 273</a>. However, the NIST document <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf" rel="nofollow noreferrer">SP 800-90Ar1</a> (NIST Special Publication 800-90A Revision 1: Recommendation for Random Number Generation Using Deterministic Random Bit  Generators) specifies a total of tree mechanisms:</p>
  
  <blockquote>
    <p>Implement the three DRBG mechanisms (Hash_DRBG, HMAC_DRBG, CTR_DRBG) in 800-90Ar1 (on all platforms).</p>
  </blockquote>
  
  <p>However, although you might expect that we would now have three methods to create such secure random algorithms:</p>
  
  <ol>
  <li><code>SecureRandom.getInstance("Hash_DRBG")</code></li>
  <li><code>SecureRandom.getInstance("HMAC_DRBG")</code></li>
  <li><code>SecureRandom.getInstance("CTR_DRBG")</code></li>
  </ol>
  
  <p>possibly with various configuration parameters, we seem to have only one:</p>
  
  <ol>
  <li><code>SecureRandom.getInstance("DRBG")</code></li>
  </ol>
  
  <p>So how can the developer configure and detect which one of the algorithms is used?</p>