code: @Nonnull
    private static SecureRandom _createSecureRandomInstance ()
    {
      SecureRandom aSecureRandom;
      try
      {
        if (LOGGER.isDebugEnabled ())
          LOGGER.debug ("Trying to get SecureRandom: IBMSecureRandom, IBMJCE");
  
        // IBM JCE
        // http://www.ibm.com/developerworks/java/jdk/security/50/secguides/JceDocs/api_users_guide.html
        aSecureRandom = SecureRandom.getInstance ("IBMSecureRandom", "IBMJCE");
  
        if (LOGGER.isDebugEnabled ())
          LOGGER.debug ("Using SecureRandom: IBMSecureRandom, IBMJCE");
      }
      catch (final Exception ex)
      {
        try
        {
          // Try to use /dev/urandom first - on Linux machines this is preferred
          // On Windows this throws a NoSuchAlgorithmException
  
          if (LOGGER.isDebugEnabled ())
            LOGGER.debug ("Trying to get SecureRandom: NativePRNGNonBlocking");
  
          // Oracle
          // http://docs.oracle.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html
          // http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html
          // http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html
          aSecureRandom = SecureRandom.getInstance ("NativePRNGNonBlocking");
  
          if (LOGGER.isDebugEnabled ())
            LOGGER.debug ("Using SecureRandom: NativePRNGNonBlocking");
        }
        catch (final Exception ex2)
        {
          // Fallback for Windows
  
          if (LOGGER.isDebugEnabled ())
            LOGGER.debug ("Trying to get default SecureRandom");
  
          // Default
          aSecureRandom = new SecureRandom ();
  
          if (LOGGER.isDebugEnabled ())
            LOGGER.debug ("Using default SecureRandom");
        }
      }
      return aSecureRandom;
    }
docs: Create a new {@link SecureRandom} instance. First the IBM secure random is
  tried, than the SHA1PRNG secure random and finally if the previous ones
  failed, the default instance is used. In certain circumstances (Linux +
  some Java version; most likely using the blocking '/dev/random') this
  initialization takes forever and that's why the debug statements are added.
  
  @return A new {@link SecureRandom} instance. Never <code>null</code>.