Re: ENTROPY EXHAUSTION IN JAVA FIPS

Hi,

Am 30.10.2019 um 11:41 schrieb Eckenfels. Bernd:

> It might be a work around, [using haveged or rng-tools]
> 
> In my experience this avoids blocking /dev/random

It helps for a local system but if you provide a software you expect
customers to install on their own systems it's a bad start for a
discussion if the reason is that a mission critical production system
stopped working due to a blocked /dev/random.

Using haveged as a work around for a blocking /dev/random is
esentially admitting that the randomness of /dev/random and
/dev/urandom are of the same quality and that it's enough for
your needs (which I state is the case for >99.9% of current
uses of BouncyCastle "out there"). Same for rng-tools without
some random number generator available to it.


Cheers, Lothar