RDRAND Provider

A secure random provider that uses the RDRAND hardware instruction.

License	MIT
Categories	IDE Development Tools
GroupId	com.github.marschall
ArtifactId	rdrand-provider
Last Version	0.1.0
Release Date	Apr 1, 2018
Type	jar
Description	RDRAND Provider A secure random provider that uses the RDRAND hardware instruction.
Project URL	https://github.com/marschall/rdrand-provider
Source Code Management	https://github.com/marschall/rdrand-provider

Download rdrand-provider

Filename	Size
rdrand-provider-0.1.0.pom
rdrand-provider-0.1.0.jar	11 KB
rdrand-provider-0.1.0-sources.jar	8 KB
rdrand-provider-0.1.0-javadoc.jar	375 KB

How to add to project

Apache Maven

<!-- https://jarcasting.com/artifacts/com.github.marschall/rdrand-provider/ -->
<dependency>
    <groupId>com.github.marschall</groupId>
    <artifactId>rdrand-provider</artifactId>
    <version>0.1.0</version>
</dependency>

Gradle Groovy

// https://jarcasting.com/artifacts/com.github.marschall/rdrand-provider/
implementation 'com.github.marschall:rdrand-provider:0.1.0'

Gradle Kotlin

// https://jarcasting.com/artifacts/com.github.marschall/rdrand-provider/
implementation ("com.github.marschall:rdrand-provider:0.1.0")

Apache Buildr

'com.github.marschall:rdrand-provider:jar:0.1.0'

Apache Ivy

<dependency org="com.github.marschall" name="rdrand-provider" rev="0.1.0">
  <artifact name="rdrand-provider" type="jar" />
</dependency>

Groovy Grape

@Grapes(
@Grab(group='com.github.marschall', module='rdrand-provider', version='0.1.0')
)

Scala SBT

libraryDependencies += "com.github.marschall" % "rdrand-provider" % "0.1.0"

Leiningen

[com.github.marschall/rdrand-provider "0.1.0"]

Dependencies

compile (1)

Group / Artifact	Type	Version
org.openjdk.jol : jol-core	jar	0.9

test (4)

Group / Artifact	Type	Version
org.junit.jupiter : junit-jupiter-api	jar	5.1.0
org.junit.jupiter : junit-jupiter-engine	jar	5.1.0
org.junit.platform : junit-platform-launcher	jar	1.1.0
org.assertj : assertj-core	jar	3.9.1

Project Modules

There are no modules declared in this project.

RDRAND SecureRandomSPI

A SecureRandomSPI that makes the RDRAND and RDSEED available to SecureRandom.

• does not use syscalls
• uses JNI criticals to avoid allocation and copying
• is marked as thread safe so concurrent access through SecureRandom will not synchronize in Java 9 and later, offering additional parallelism
• unlike the NativePRNG variants
  • does not use a file handle
  • does not have a global lock
  • does not additionally mix with SHA1PRNG
  • zeros out native memory
• supports the ServiceLoader mechanism
• is a Java 9 module but works on Java 8
• no dependencies outside the java.base module

Usage

An instance of the provider can be acquired using

SecureRandom.getInstance("rdrand"); // RdrandProvider.ALGORITHM

Configuration

The provider can be configured in two different ways

1. programmatic configuration
2. static configuration

For best startup performance it is recommended to extract the .so from the JAR and add it to a folder present in the LD_LIBRARY_PATH environment variable or the java.library.path system property. Otherwise this library will extract the .so to a temporary folder the first time it is called.

Programmatic Configuration

The provider can be registered programmatically using

Security.addProvider(new RdrandProvider());

Static Configuration Java 8

The provider can be configured statically in the java.security file by adding the provider at the end

security.provider.N=com.github.marschall.rdrand.RdrandProvider

N should be the value of the last provider incremented by 1. For Oracle/OpenJDK 8 on Linux N should likely be 10.

This can be done per JVM installation or per JVM Instance.

Note that for this to work the provider JAR needs to be in the class path or extension folder.

Static Configuration Java 9+

The provider can be configured statically in the java.security file by adding the provider at the end

security.provider.N=rdrand

N should be the value of the last provider incremented by 1. For Oracle/OpenJDK 9 on Linux N should likely be 13.

This can be done [per JVM installation or per JVM Instance.

The provider uses the ServiceLoader mechanism therefore using the rdrand string is enough, there is no need to use the fully qualified class name.

Note that for this to work the provider JAR needs to be in the class path or module path.

Performance

Performance compared to NativePRNGNonBlocking is similar for small, single threaded workloads but a lot better for multi threaded workloads.

Usage for Tomcat Session Ids

This security provider can be used for session id generation in Tomcat. In order for that several things need to be configured:

1. the JAR needs to be added to the class path
2. the .so should be added to the Java library path (java.library.path)
3. the provider needs to be installed into the JVM via java.security.properties
4. Tomcat needs to be configured to use the algorithm

Points 1, 2 and 3 can be configured in CATALINA_BASE/bin/setenv.sh

#!/bin/sh

CLASSPATH="/path/to/rdrand-provider-0.1.0.jar"
CATALINA_OPTS="$CATALINA_OPTS -Djava.library.path=/path/to/folder/with/so -Djava.security.properties=/path/to/jvm.java.security"

export CLASSPATH
export CATALINA_OPTS

Point can be configured on the Manager Component in conf/context.xml by setting secureRandomAlgorithm to rdrand

<Manager secureRandomAlgorithm="rdrand">
</Manager>

Versions

Version
0.1.0 Apr 1, 2018