News for hackers. Stuff that matters.

A comment on Ruby Bug: SecureRandom should try /dev/urandom first.

Re:Ruby Bug: SecureRandom should try /dev/urandom first by Freaky on Tuesday May 03, 2016 @11:21PM (#11625922)
JRuby uses Java's java.security.SecureRandom, which (by default on OpenJDK 8) uses /dev/random, mixed with its own SHA1PRNG (this so setSeed() can be guaranteed to actually do something).

Rubinius copies MRI circa 2014 via rubysl - https://github.com/rubysl/rubysl-securerandom

[ Parent | on HN ]
Re:Ruby Bug: SecureRandom should try /dev/urandom first by viraptor on Wednesday May 04, 2016 @12:09AM (#11626120)
Does it really? From https://bugs.openjdk.java.net/browse/JDK-4705093 :

> If you call: new SecureRandom() on Linux and the default values are used, it will read from /dev/urandom and not block. (By default on Solaris, the PKCS11 SecureRandom is used, and also calls into /dev/urandom.)

[ Parent | on HN ]
Re:Ruby Bug: SecureRandom should try /dev/urandom first by jcranmer on Wednesday May 04, 2016 @01:45AM (#11626475)
I ran strace on both OpenJDK 7 and 8. It appears to open both /dev/random and /dev/urandom, but it only read from /dev/urandom. From reading the source code, it appears that /dev/random is used if you call SecureRandom::generateSeed, but /dev/urandom is used for SecureRandom::next.

Of course, you can change a whole heck of a lot of stuff by setting properties on the command line or changing $JAVA_HOME/lib/security/java.security.

[ Parent | on HN ]
Re:Ruby Bug: SecureRandom should try /dev/urandom first by Freaky on Wednesday May 04, 2016 @07:31AM (#11627588)
Yep, shouldn't have second-guessed myself. Teach me to comment at 4am.

http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/687fd7c7986d/s...

[ Parent | on HN ]