 <p>Basically this code relies on a little trick: if you seed the SHA1PRNG for the SUN provider and Bouncy Castle provider before it is used then it will always generate the same stream of random bytes. This is not always the case for every provider though; other providers simply mix in the seed. In other words, they may use a pre-seeded PRNG. In that case the <code>getRawKey</code> method generates different keys for the encrypt and decrypt, which will result in a failure to decrypt.</p> <p>Basically this horrible code snippet abuses the SHA1PRNG as a Key Derivation Fucntion or KDF. You should use a true KDF such as PBKDF2 if the input is a password or HKDF if the input is a key.</p> <p>That code snippet should be removed. It has been copied from Android snippets, but I cannot find that site anymore.</p>