Hacker News Reader

Comment by tudelo | Hacker News Reader

I used to work on a Java application that used a bunch of libraries, and specifically I remember one of the libraries generated some identifier using urandom. I think it was axis2 or something like that. There was unexplainably random hangs when trying to read from urandom. The wikipedia article says that urandom should not block. Anyone smarter than me that can understand this article have any reason why urandom hangs?

View on HN

Java on Linux at used to have this bad behavior where it would short-circuit configuration to use /dev/urandom to use its own internal RNG based on /dev/random. It did not create a single global seed for the internal random number generator, so some systems could overwhelm the entropy pool.

I've solved this for some systems by changing the java security properties file to instead point to /dev/./urandom .

I did that and even then it still happened :( one of lifes great mysteries

Impossible to say without a deeper inspection of the system, but given `/dev/random` does block, the answer is something is redirecting urandom to random. On the system, does cat urandom ever block? Step one is the reproduce it outside of Java and if that's not possible, start digging into the Java library's code. If it is, then start digging into `glibc`, devfs, the kernel.

Something in the chain switched urandom and random. Isolate each component until the culprit is found.

Java app servers with high request rates suffered this problem, leading to throttling of SSL session creation and thus reducing effective requests per second on the server.

I doubled throughput on two different projects by 'fixing' the /dev/random-/dev/urandom problem.

But writing your own can be worse. Stumbled onto a substantial CSRNG bug on an embedded system than was ignoring most of the seed data due to a premature optimization in the ingestion code. Even after that the people who wrote the glue code wanted to do their own entropy mixing. Lesson not learned, at all.

After boot, and once it's been initialized with sufficient entropy, the /dev/urandom PRNG should not block. Can you provide more detail as to what it was doing?

Reply on news.ycombinator.com