Unit tests should not depend on random values nor deplete system entropy

[unzvfu]

Apparently some unit tests use system entropy. This is a bad idea because

• system entropy is a very valuable resource that needs to be shared;
• unit tests should not depend on truly random values; the prng should be seeded with a known value to ensure reproducibility of errors.

[unzvfu]

After more investigation it looks like there is no easy way to refactor the code base so that the random number generator can be parameterised (which it should be throughout, not just in the tests). This will be a big, public interface-breaking job.

[wilko77]

another possible avenue:
Java lets you choose which CryptoProvider you want to use inside the JVM. We could implement our own Test Provider which just provides some not so secure random number generator. (more details: https://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Steps)