http token generation is taking time

[Suhas Shejwal]

Team,

The http token generating is taking long time. Nothing is unusual in Gerrit logs and Host Ubuntu System resources are underutilized  

Please suggest 

[Luca Milanesio]

On 11 Sep 2024, at 05:49, 'Suhas Shejwal' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:

Team,

The http token generating is taking long time.

You need to check the random number generator of the system and why it is taking time.

You could also alternatively use a Docker container and mount /dev/urandom as /dev/random to increase the speed and have less entropy.

For more insights on /dev/random vs. /dev/urandom, see [1]

HTH

Luca.

[1] https://unix.stackexchange.com/questions/324209/when-to-use-dev-random-vs-dev-urandom

Nothing is unusual in Gerrit logs and Host Ubuntu System resources are underutilized  

Please suggest 

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/6a3655c0-2888-496b-8015-addf14837cbbn%40googlegroups.com.

[Matthias Sohn]

The password is generated using SecureRandom with algorithm SHA1PRNG [1] which is based

on /dev/random on Linux to get some true random bytes [2].

Gerrit uses bouncycastle's org.bouncycastle.crypto.generators.BCrypt [3] to hash the password.

Only the hash of this password is persisted. This was introduced in [4].

Bouncycastle 2.73.3 has some performance improvements in this area [5].

[1] https://gerrit-review.googlesource.com/c/gerrit/+/46280/5/gerrit-server/src/main/java/com/google/gerrit/server/account/PutHttpPassword.java#50

     https://docs.oracle.com/en/java/javase/21/docs/specs/security/standard-names.html#securerandom-number-generation-algorithms

[2] https://stackoverflow.com/questions/137212/how-to-deal-with-a-slow-securerandom-generator

[3] https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/crypto/generators/BCrypt.java

[4] https://gerrit-review.googlesource.com/c/gerrit/+/96370

[5] https://github.com/bcgit/bc-java/issues/652

 

-Matthias

[Suhas Shejwal]

Thank you  Matthias and Luka for looking into it. Will check  random number generator of the system