<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 1/23/17 3:21 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE11BF8A292@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">I was not able to set jdk.certpath.disabledAlgorithms as a system property
(i.e. -D), I don’t see any doc that that should work.
</pre>
</blockquote>
<pre wrap="">
You can set the PNRG property that way and that's also defined in that same file. I just assumed it would apply to any of them.</pre>
</blockquote>
<br>
<br>
So nuts and bolts question: Just to be clear, what/how *exactly*
are you setting this way?<br>
<br>
It rang a bell for me in the other place where you mentioned, so I
just looked at a new app server I set up recently and there I am
indeed effectively setting the PRNG entropy source via the system
property "java.security.egd" via a -D.<br>
<br>
So I looked at java.security and the conceptual discrepancy became
clear from the comments there. The java.security property that sets
this (I think technically for the "Sun" provider, that provides
their impl of SecureRandom) is actually "securerandom.source".
However, that specific one can be overriden with the system property
"java.security.egd". An excerpt from the comments for
"securerandom.source":<br>
<br>
<tt># Sun Provider SecureRandom seed source.</tt><tt><br>
</tt><tt>#</tt><tt><br>
</tt><tt># Select the primary source of seed data for the "SHA1PRNG"
and</tt><tt><br>
</tt><tt># "NativePRNG" SecureRandom implementations in the "Sun"
provider.</tt><tt><br>
</tt><tt># (Other SecureRandom implementations might also use this
property.)</tt><tt><br>
</tt><tt>#</tt><tt><br>
</tt><tt># ...snip...</tt><tt><br>
</tt><tt>#</tt><br>
<tt># The entropy gathering device can also be specified with the
System</tt><tt><br>
</tt><tt># property "java.security.egd". For example:</tt><tt><br>
</tt><tt>#</tt><tt><br>
</tt><tt># % java -Djava.security.egd=<a class="moz-txt-link-freetext" href="file:/dev/random">file:/dev/random</a>
MainClass
</tt><tt><br>
</tt><tt>#</tt><tt><br>
</tt><tt># Specifying this System property will override the</tt><tt><br>
</tt><tt># "securerandom.source" Security property.</tt><br>
<br>
<br>
So that all jibes with what I earlier vaguely thought was the case,
which was: The props in java.security are not system properties.
They are properties specific to the java.security.Security security
provider service class, which may be used by loaded security
providers. In general you can't specify them individually as system
properties. As we see for the SecureRandom seed, specific security
providers that are loaded *can* use system properties as overrides
(or maybe even as the sole way to set something), but that's going
to be on a provider-specific basis. <br>
<br>
Looking at the source for java.security.Security seems to confirm:
These is no use of System.getProperty and friends there, except for
the system property "java.security.properties", which allows
specifying a full file of properties, which we already knew from Tom
(and for getting the actual "jre/lib/security" path relative to
java.home, but that's not user input).<br>
<br>
FYI, the only other comments re use of system properties there are
for allowing a system prop for security manager policy:<br>
<br>
<tt># whether or not we allow an extra policy to be passed on the
command line</tt><tt><br>
</tt><tt># with -Djava.security.policy=somefile. Comment out this
line to disable</tt><tt><br>
</tt><tt># this feature.</tt><tt><br>
</tt><tt>policy.allowSystemProperty=true<br>
<br>
<br>
</tt><br>
</body>
</html>