A DESCRIPTION OF THE PROBLEM :
sun.security.provider.SecureRandom default constructor javadoc says:

> This empty constructor automatically seeds the generator....

But it doesn't seed the generator at all as you can see from the following code excerpts from https://hg.openjdk.java.net/jdk/jdk/ around r47216:

public SecureRandom() {
  init(null);
}
...
private void init(byte[] seed) {
  ...
  if (seed != null) {
    engineSetSeed(seed);
  }
}

Where no seeding happens for the default constructor.