JDK-8014224 : KeyStore.store takes several minutes on PKCS12
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 6
  • Priority: P3
  • Status: Resolved
  • Resolution: Duplicate
  • Submitted: 2013-04-04
  • Updated: 2014-11-17
  • Resolved: 2014-05-11
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6
6-poolResolved
Related Reports
Duplicate :  
Description
FULL PRODUCT VERSION :
java 64-bit server vm build 20.13-b06 mixed mode

ADDITIONAL OS VERSION INFORMATION :
linux  ca-server 3.5.0-17-generic x86_64
Ubuntu 12.10

A DESCRIPTION OF THE PROBLEM :
I've tried to load a key into my soft p12 store. But it took several minutes with jrockit and oracle jdk. When I tried the openjdk it worked correctly.
I'm not sure if it matters but my ubuntu server is inside of vmware ESX.
I've attached a simple program which takes several minutes with oracle jdk and jrockit. on ubuntu.


ERROR MESSAGES/STACK TRACES THAT OCCUR :
No error message

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
System.out.println( " Started creating " );
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
KeyPairGenerator generator = KeyPairGenerator.getInstance( " RSA " ,  " BC " );
generator.initialize(2048);
KeyPair keys = generator.generateKeyPair();
String password =  " passpass " ;
KeyStore.PasswordProtection passProtectionEntry = new KeyStore.PasswordProtection(password.toCharArray());

KeyStore storeP12 = KeyStore.getInstance( " PKCS12 " );
storeP12.load(null, password.toCharArray());

ByteArrayOutputStream bus = new ByteArrayOutputStream();

storeP12.store(bus, password.toCharArray());
bus.flush();
bus.close();

System.out.println( " Done creating " );
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
use openjdk
Comments
I agree with Sean's assessment.
12-05-2014

JDK 6 version of : PKCS12KeyStore.getSalt() : private byte[] getSalt() { // Generate a random salt. byte[] salt = new byte[SALT_LEN]; if (random == null) { random = new SecureRandom(); } salt = random.generateSeed(SALT_LEN); return salt; } The random.generateSeed is an expensive call leading to NativePRNG seed generation. I don't think it's necessary and we could adopt the JDK 7 approach of just using securerandom to generate the 20 bytes (SALT_LEN) : random.nextBytes(salt) found the code responsible for JDK 7 change : JDK-6491602
11-05-2014

The underlying problem is due to random number generation (PRNG) rather than PKCS12. The supplied program takes 1-2 minutes to run using JDK 6u51 on Ubuntu Linux 12.04 (instead of the expected 1-2 seconds). The program appears to be stalled while waiting for entropy during random number generation. The stack trace is as follows: "main" prio=10 tid=0x00007f29dc007000 nid=0x580e runnable [0x00007f29e3739000] java.lang.Thread.State: RUNNABLE at java.io.FileInputStream.readBytes(Native Method) at java.io.FileInputStream.read(FileInputStream.java:220) at sun.security.provider.NativePRNG$RandomIO.readFully(NativePRNG.java:185) at sun.security.provider.NativePRNG$RandomIO.implGenerateSeed(NativePRNG.java:202) - locked <0x00000007d87be628> (a java.lang.Object) at sun.security.provider.NativePRNG$RandomIO.access$300(NativePRNG.java:108) at sun.security.provider.NativePRNG.engineGenerateSeed(NativePRNG.java:102) at java.security.SecureRandom.generateSeed(SecureRandom.java:495) at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.getSalt(PKCS12KeyStore.java:477) at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.calculateMac(PKCS12KeyStore.java:834) at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineStore(PKCS12KeyStore.java:788) - locked <0x00000007d6ced590> (a com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore) at java.security.KeyStore.store(KeyStore.java:1115) at ji.main(ji.java:22)
12-04-2013