[mattvanhorn]

...and that you can remove all the existing ones and insert your own.

[spiralpolitik]

You can't change Providers while running under the SecurityManager he specifies you must use in the rules.

SecurityManager.checkSecurityAccess(java.lang.String) is called if you try and mess with the Providers.

[cromwellian]

You're right, looks like a Timing Attack might be the only solution that satisfies the spirit of the test.