securerandom.source vs java.security.egd Java System properties difference

I turns out that not possible to find full list of Java properties other than basic.

I want to understand difference of securerandom.source vs java.security.egd

When I run printing out from within Java main method:

System.out.println("Secure random source: " + Security.getProperty("securerandom.source"));
System.out.println("java.security.egd: " + System.getProperty("java.security.egd"));

I get (on JDK 17):

Secure random source: file:/dev/random
java.security.egd: null

JDK 11 https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-9DC4ADD5-6D01-4B2E-9E85-B88E3BEE7453 and JDK 17 https://docs.oracle.com/en/java/javase/17/security/oracle-providers.html#GUID-C4706FFE-D08F-4E29-B0BE-CCE8C93DD940 both say file:/dev/random is already default, and setting it is not needed.

if the entropy gathering device in java.security is set to file:/dev/urandom or file:/dev/random, then NativePRNG is preferred to SHA1PRNG

But NativePRNG algorithm is already used by default:

SecureRandom secureRandom = new SecureRandom();
System.out.println("Algorithm: " + secureRandom.getAlgorithm());

Output

Algorithm: NativePRNG

My feelings are that specifying java.security.egd is not needed, but I cannot get documentation prove of it.

The https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html says

SHA1PRNG and NativePRNG were fixed to properly respect the SecureRandom seed source properties in the java.security file. The obscure workaround using file:///dev/urandom and file:/dev/./urandom is no longer required

But it does not say, there is no need to use java.security.egd.

What is securerandom.source vs java.security.egd Java System properties difference ?

Yes, this is older staff in many places

https://cwiki.apache.org/confluence/display/TOMCAT/HowTo+FasterStartUp (last edit 2017) has

There is a way to configure JRE to use a non-blocking entropy source by setting the following system property: -Djava.security.egd=file:/dev/./urandom

Solution

But it does not say, there is no need to use java.security.egd.

I think you've hit the nail on the head.

First, searching "EGD" in $JAVA_HOME/conf/security/java.security provides documentation for securerandom.source, not for java.security.egd.

Second, that documentation states:

By default, an attempt is made to use the entropy gathering device specified by the "securerandom.source" Security property.

The entropy gathering device can also be specified with the System property "java.security.egd".

Specifying this System property will override the "securerandom.source" Security property.

From these two clues I understand the official setting is securerandom.source and that java.security.egd is still supported for compatibility reasons.

Full quote:

#
# Sun Provider SecureRandom seed source.
#
# Select the primary source of seed data for the "NativePRNG", "SHA1PRNG"
# and "DRBG" SecureRandom implementations in the "Sun" provider.
# (Other SecureRandom implementations might also use this property.)
#
# On Unix-like systems (for example, Linux/MacOS), the
# "NativePRNG", "SHA1PRNG" and "DRBG" implementations obtains seed data from
# special device files such as file:/dev/random.
#
# On Windows systems, specifying the URLs "file:/dev/random" or
# "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding
# mechanism for SHA1PRNG and DRBG.
#
# By default, an attempt is made to use the entropy gathering device
# specified by the "securerandom.source" Security property.  If an
# exception occurs while accessing the specified URL:
#
#     NativePRNG:
#         a default value of /dev/random will be used.  If neither
#         are available, the implementation will be disabled.
#         "file" is the only currently supported protocol type.
#
#     SHA1PRNG and DRBG:
#         the traditional system/thread activity algorithm will be used.
#
# The entropy gathering device can also be specified with the System
# property "java.security.egd". For example:
#
#   % java -Djava.security.egd=file:/dev/random MainClass
#
# Specifying this System property will override the
# "securerandom.source" Security property.
#
# In addition, if "file:/dev/random" or "file:/dev/urandom" is
# specified, the "NativePRNG" implementation will be more preferred than
# DRBG and SHA1PRNG in the Sun provider.
#
securerandom.source=file:/dev/random