hiero-ledger / hiero-ledger/hiero-consensus-node

Switch to sourcing random numbers from `/dev/urandom`

Open
#13,841 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
406
Forks
226
Avg merge
3d 4h
Merged PRs (30d)
210

Description

### Problem

Spinning off a new issue from https://github.com/hashgraph/hedera-services/issues/5364, which was closed.

Right now, we have to run havaged on all of the consensus nodes. If we don't run havaged, /dev/random starts blocking on reads eventually. havaged must be run as a privileged container to be able to feed entropy to the kernel. This is not ideal.
We'll also see some minor issues as we move towards more modern ways of orchestrating our containers (where two instances of the havaged container could be running at the same time, which is something that should be avoided).

Additionally, the quality of the entropy that havaged provides is not guaranteed and is sometimes contested (see banner on https://wiki.archlinux.org/title/Haveged for details).

We're adding additional operational complexity and not gaining much from it.

### Solution

Start Java with the right flags to read from /dev/urandom instead of /dev/random. This solution was suggested by Leemon in https://github.com/hashgraph/hedera-services/issues/5364#issuecomment-1454327461

Once that's done, we can get rid of havaged and simplify our deployments a bit.

### Alternatives

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the Java startup configuration that controls whether random numbers come from /dev/random or /dev/urandom, then find the deployment configuration for havaged. Confirm how the service is launched and how havaged is currently required. Done means Java uses /dev/urandom and the havaged container is no longer needed in deployments.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
devops, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.