<html><body><div dir="ltr"><div style="">
</div><div style=""><div>
<div dir="ltr">Good finding,</div><div dir="ltr"><br></div><div dir="ltr"> but just a related comment: it has been customary to request sha1prng, but that practice should be re-evaluated since all new RNG mode features (including the parameters) are absent in that implementation amd it might sooner or later create compliance issues by the use of outdated sha1.</div><div dir="ltr"><br></div><div dir="ltr">(Having said that I also have some places to change and cannot fully judge if the performance gets worse or the blocking problems re-occur. Maybe that would be a good candidate for a blog/statement. Especially given newer Linux kernel versions with changed /dev/random semantics, as well).</div><div dir="ltr"><br></div><div dir="ltr">Gruss</div><div dir="ltr">Bernd</div>
<div id="ms-outlook-mobile-signature"><div><br></div><div><br></div><div style="direction:ltr">-- </div><div style="direction:ltr">http://bernd.eckenfels.net</div></div>
</div>
<div> </div><hr style="display:inline-block;width:98%" tabindex="-1"><div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>Von:</b> core-libs-dev <core-libs-dev-retn@openjdk.org> im Auftrag von 구태진 <koo.taejin@gmail.com><br><b>Gesendet:</b> Freitag, April 28, 2023 8:06 AM<br><b>An:</b> core-libs-dev@openjdkorg <core-libs-dev@openjdk.org><br><b>Betreff:</b> There is unnecessary resource consumption in `SecureRandom.getInstance()`.<div> </div></font></div><div dir="ltr">Hello, this is my first e-mail at this mailng-list.<br><br>It is an honor for me to write an e-mail here. :)<br>If I misunderstood and wrote an email, please forgive me.<br><div><br></div><div>- reproduction code</div><div> tested on oracle-openjdk-20.0.1 and temurin-17.0.3</div><div>```</div><div>SecureRandom.getInstance("SHA1PRNG")</div><div>```</div><div><br></div><div>The reason it's slow is because exception is created during this operation. (result is ok.)<br></div><div><br></div><div>```</div><div>java.lang.NoSuchMethodException.<init>()<br> at java.lang.Class.getConstructor0(Class.java:3585)<br> at java.lang.Class.getConstructor(Class.java:2271)<br> at java.security.Provider$Service.newInstanceUtil(Provider.java:1896)<br> at java.security.Provider$Service.newInstance(Provider.java:1861)<br> at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)<br> at sun.security.jca.GetInstance.getInstance(GetInstance.java:164) <br> at java.security.SecureRandom.getInstance(SecureRandom.java:387<br></div><div>```</div><div><br></div><div>I looked up why the exception was being created.<br></div><div><a href="https://github.com/openjdk/jdk/blob/0deb648985b018653ccdaf193dc13b3cf21c088a/src/java.base/share/classes/java/security/Provider.java#L1587" style="">https://github.com/openjdk/jdk/blob/0deb648985b018653ccdaf193dc13b3cf21c088a/src/java.base/share/classes/java/security/Provider.java#L1587</a></div><div><span style="box-sizing:border-box; font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace; font-size:12px; white-space:pre-wrap">// addEngine</span><span style="font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace; font-size: 12px; white-space: pre-wrap; color: rgb(31, 35, 40); background-color: rgb(255, 248, 197);">(</span><span style="box-sizing:border-box; font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace; font-size:12px; white-space:pre-wrap">"SecureRandom"</span><span style="font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace; font-size: 12px; white-space: pre-wrap; color: rgb(31, 35, 40); background-color: rgb(255, 248, 197);">, </span><span style="box-sizing:border-box; font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace; font-size:12px; white-space:pre-wrap">false, </span><span style="box-sizing:border-box; font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace; font-size:12px; white-space:pre-wrap">"java.security.SecureRandomParameters"</span><span style="font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace; font-size: 12px; white-space: pre-wrap; color: rgb(31, 35, 40);">);</span><br></div><div><span style="font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace; font-size: 12px; white-space: pre-wrap; color: rgb(31, 35, 40);"><br></span></div><div>It looks that is specifying a constructor for SecureRandom at this point.</div><div>But SecureRandom looks it doesn't have that constructor (It looks like SecureRandomSpi has that constructor .).<br></div><div><br></div><div>For this reason, the initial creation fails and an exception is created.<br>As an alternative, it seems that created using a constructor without arguments.</div><div>```</div><div>// java.security.Provider.Service#newInstanceUtil</div><div>private Object newInstanceUtil(Class<?> ctrParamClz, Object ctorParamObj)<br> throws Exception<br> {<br> if (ctrParamClz == null) {<br> return newInstanceOf();<br> } else {<br> // Looking for the constructor with a params first and fallback<br> // to one without if not found. This is to support the enhanced<br> // SecureRandom where both styles of constructors are supported.<br> // Before jdk9, there was no params support (only getInstance(alg))<br> // and an impl only had the params-less constructor. Since jdk9,<br> // there is getInstance(alg,params) and an impl can contain<br> // an Impl(params) constructor.<br> try {<br> Constructor<?> con = getImplClass().getConstructor(ctrParamClz);<br> return con.newInstance(ctorParamObj);<br> } catch (NoSuchMethodException nsme) {<br> // For pre-jdk9 SecureRandom implementations, they only<br> // have params-less constructors which still works when<br> // the input ctorParamObj is null.<br> //<br> // For other primitives using params, ctorParamObj should not<br> // be null and nsme is thrown, just like before.<br> if (ctorParamObj == null) {<br> try {<br> return newInstanceOf();<br> } catch (NoSuchMethodException nsme2) {<br> nsme.addSuppressed(nsme2);<br> throw nsme;<br> }<br> } else {<br> throw nsme;<br> }<br> }<br> }<br> }<br></div><div>```</div><div><br></div><div>There are two solutions I think.<br><br>1. Create a constructor for SecureRandom.<br>2. Compare using getConstructors instead of getConstrctor.<br></div><div><br></div><div>Thanks for reading. :)<br></div></div>
</div></div></body></html>