United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: 6521844 SecureRandom hangs on Linux Systems
6521844 : SecureRandom hangs on Linux Systems

Details
Type:
Bug
Submit Date:
2007-02-06
Status:
Closed
Updated Date:
2012-12-15
Project Name:
JDK
Resolved Date:
2011-05-02
Component:
security-libs
OS:
linux
Sub-Component:
java.security
CPU:
x86
Priority:
P5
Resolution:
Fixed
Affected Versions:
6
Fixed Versions:
7

Related Reports
Backport:
Duplicate:
Relates:
Relates:

Sub Tasks

Description
The JCK test api/java_security/SecureRandom/SecureRandomTests.html#misc
can hang on Linux platforms if there is no other activity on the system.

This bug appears to have been in the system for several releases.

This is caused by code in the NativePRNG.java file accessing /dev/random and blocking.
I believe these suspect code is this method. 

        private byte[] implGenerateSeed(int numBytes) 

On some Linux systems we get an initial stream of bytes from /dev/random that can
satisfy the Seed requirement but others return nothing unless there is additional system
activity.


/java/re/jdk/6.0/latest/ws/j2se/src/solaris/classes/sun/security/provider/NativePRNG.java

Although the JRE is supposed to support selecting /dev/urandom in the java.security properties file, this code appears to ignore this selection.  To attempt to work around this problem we have attempted to set the command line property:
 -Djava.security.egd=file:/dev/urandom 
and make sure that the java.security file contains this setting:
  securerandom.source=file:/dev/urandom

This still causes hangs on several Linux boxes tested.  The test can be made to pass if there is consistent mouse or keyboard activity.  This is obviously not an acceptable workaround.

If the user has selected a less secure random number source (/dev/urandom), our
SecureRandom implementation should honor that and not hang.

In addition to the JCK hangs, this problem could manifest itself with unacceptable performance degredation in customer applications that would be very difficult to diagnose.

                                    

Comments
EVALUATION

Add clarifications into SecureRandom spec.

Will also add details on Sun JDK implementations into the security guide.
                                     
2007-08-14
WORK AROUND

set securerandom.source to file:/dev/./urandom as described in http://monaco.sfbay/detail.jsf?cr=6202721
                                     
2007-03-03
EVALUATION

Hanging at generateSeed is not a bug, since that's what was designed:

    When the entropy pool is empty, reads from /dev/random will block until
    additional environmental noise is gathered.
    (Source: Linux Programmer's Manual, section 4) 

Alternatively, set securerandom.source to file:/dev/./urandom as described in http://monaco.sfbay/detail.jsf?cr=6202721
                                     
2007-02-12



Hardware and Software, Engineered to Work Together