ENTROPY EXHAUSTION IN JAVA FIPS
Jon Moroney <[email protected]> Tue, 29 Oct 2019 17:16:57 -0700
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I=E2=80=99ve been doing a bunch of performance testing with a code base = that I=E2=80=99m attached to and I=E2=80=99ve noticed that using the BC = fips security provider my code exhausts the entropy available on my = intel haswell linux machines. This is using the 1.0.2 version of the = library. Ex. cat /proc/sys/kernel/random/entropy_avail=20 Shows values under 10 while my code it running. When I use the system default security provider the available number = never drops below 3000. I mention the cpu arch because I=E2=80=99ve also = tried this on a Skylake machine and I do not see the entropy exhaustion = there and I believe that=E2=80=99s down to intel providing hardware = random number generation on Broadwell and later. I=E2=80=99m adding BC as my default provider via Security.insertProviderAt(new BouncyCastleFipsProvider(), 1); Pretty much at the entry point to my program. So, my question is; am I = simply misconfiguring something here? I saw a bug around this in the = release notes here https://www.bouncycastle.org/fips-java/RELEASE_NOTES.md Is this a known issue for 1.0.2 as well? The current known issues list is blank https://www.bouncycastle.org/fips-java/BC-FJA-KnownIssues-1.0.2.csv Thanks, Jon=