Re: Availability and configuration of BCFIPS/BCJSSE Provider for JDK11

> -   Also, with JDK9 the ability to pass extra parameters to the Security Providers on load time was removed as well. (Related issue that refers to the behavior change: [2]). This, however, is the only available way to configure SunJSSE or BCJSSE to use the BCFIPS provider, and as such put the JSSE provider in FIPS Mode [3]. Would you plan to release a BCJSSE Procider that is pre-configured in FIPS mode?

To be clear, trying to load BouncyCastleJsseProvider with a parameter is not possible because Provider throws an UnsupportedOperationException and BCJSSE is not loaded at all ( see stack trace below )
Another option to releasing BCJSSE preconfigured in FIPS mode, would be to override and implement

public Provider configure(String configArg)

in BouncyCastleJsseProvider as the default implementation in Provider is what throws the unsupported operation exception after JDK 9


2> ProviderConfig: Loading legacy provider: org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
  2> ProviderConfig: Error loading provider org.bouncycastle.jsse.provider.BouncyCastleJsseProvider('fips:BCFIPS')
  2> java.lang.UnsupportedOperationException: configure is not supported
  2>    at java.base/java.security.Provider.configure(Provider.java:294)
  2>    at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
  2>    at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
  2>    at java.base/java.security.AccessController.doPrivileged(Native Method)
  2>    at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
  2>    at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
  2>    at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
  2>    at java.base/sun.security.jca.ProviderList.getIndex(ProviderList.java:296)
  2>    at java.base/sun.security.jca.ProviderList.getProviderConfig(ProviderList.java:280)
  2>    at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:286)
  2>    at java.base/sun.security.jca.GetInstance.getService(GetInstance.java:81)
  2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:206)
  2>    at java.base/java.security.Security.getImpl(Security.java:701)
  2>    at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:242)
  2>    at java.base/sun.security.provider.SecureRandom.init(SecureRandom.java:102)
  2>    at java.base/sun.security.provider.SecureRandom.<init>(SecureRandom.java:79)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom.<init>(Unknown Source)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
  2>    at java.base/java.security.AccessController.doPrivileged(Native Method)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getDefaultEntropySource(Unknown Source)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getDefaultSecureRandom(Unknown Source)
  2>    at org.bouncycastle.jcajce.provider.ProvRandom$1.createInstance(Unknown Source)
  2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$BcService.newInstance(Unknown Source)
  2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
  2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
  2>    at java.base/java.security.SecureRandom.getInstance(SecureRandom.java:364)
  2>    at java.base/java.security.SecureRandom.getDefaultPRNG(SecureRandom.java:272)
  2>    at java.base/java.security.SecureRandom.<init>(SecureRandom.java:218)
  2>    at java.base/java.io.File$TempDirectory.<clinit>(File.java:1916)
  2>    at java.base/java.io.File.createTempFile(File.java:2076)
  2>    at com.sun.jna.Native.extractFromResourcePath(Native.java:1059)
  2>    at com.sun.jna.Native.loadNativeDispatchLibraryFromClasspath(Native.java:937)
  2>    at com.sun.jna.Native.loadNativeDispatchLibrary(Native.java:922)
  2>    at com.sun.jna.Native.<clinit>(Native.java:190)
  2>    at java.base/java.lang.Class.forName0(Native Method)
  2>    at java.base/java.lang.Class.forName(Class.java:315)


‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, April 16, 2019 12:28 PM, Ioannis Kakavas <[email protected]> wrote:

> Hi there folk,
>
> Would you mind sharing your plans if any, regarding the availability of the BouncyCastleFipsProvider for JDK11 ?
>
> I can see in the roadmap [1] that 1.0.2 which is the next release, is tested against JDK11, but I'm wondering if you plan to release the provider in a way that can be installed and used with JDK11 as there doesn't seem to currently be a way.
>
> -   > JDK9 removed the extension mechanism by which external jars could be placed in jre/lib/ext. This has been one of the common ways to configure the BouncyCastleFipsProvider statically. Would you plan to release the Provider as a module instead? Granted, this can be easily overcome by adding the bc-fips jar in the classpath of the application.
>
>
> -   Also, with JDK9 the ability to pass extra parameters to the Security Providers on load time was removed as well. (Related issue that refers to the behavior change: [2]). This, however, is the only available way to configure SunJSSE or BCJSSE to use the BCFIPS provider, and as such put the JSSE provider in FIPS Mode [3]. Would you plan to release a BCJSSE Procider that is pre-configured in FIPS mode?
>
>     Best Regards
>     Ioannis
>
>     [1] https://www.bouncycastle.org/fips_java_roadmap.html
>     [2] https://bugs.openjdk.java.net/browse/JDK-8217907
>     [3] https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.7.pdf
>