Re: Re: Availability and configuration of BCFIPS/BCJSSE Provider for JDK11

Hmmm. Actually the stack trace below indicates an error in the
construction of the default DRBG for the BCFIPS provider. I think
something else might be going on here.

Regards,

David

On 22/4/19 7:26 pm, Ioannis Kakavas wrote:
>> -   Also, with JDK9 the ability to pass extra parameters to the Security Providers on load time was removed as well. (Related issue that refers to the behavior change: [2]). This, however, is the only available way to configure SunJSSE or BCJSSE to use the BCFIPS provider, and as such put the JSSE provider in FIPS Mode [3]. Would you plan to release a BCJSSE Procider that is pre-configured in FIPS mode?
> To be clear, trying to load BouncyCastleJsseProvider with a parameter is not possible because Provider throws an UnsupportedOperationException and BCJSSE is not loaded at all ( see stack trace below )
> Another option to releasing BCJSSE preconfigured in FIPS mode, would be to override and implement
>
> public Provider configure(String configArg)
>
> in BouncyCastleJsseProvider as the default implementation in Provider is what throws the unsupported operation exception after JDK 9
>
>
> 2> ProviderConfig: Loading legacy provider: org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
>   2> ProviderConfig: Error loading provider org.bouncycastle.jsse.provider.BouncyCastleJsseProvider('fips:BCFIPS')
>   2> java.lang.UnsupportedOperationException: configure is not supported
>   2>    at java.base/java.security.Provider.configure(Provider.java:294)
>   2>    at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
>   2>    at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
>   2>    at java.base/java.security.AccessController.doPrivileged(Native Method)
>   2>    at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
>   2>    at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
>   2>    at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
>   2>    at java.base/sun.security.jca.ProviderList.getIndex(ProviderList.java:296)
>   2>    at java.base/sun.security.jca.ProviderList.getProviderConfig(ProviderList.java:280)
>   2>    at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:286)
>   2>    at java.base/sun.security.jca.GetInstance.getService(GetInstance.java:81)
>   2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:206)
>   2>    at java.base/java.security.Security.getImpl(Security.java:701)
>   2>    at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:242)
>   2>    at java.base/sun.security.provider.SecureRandom.init(SecureRandom.java:102)
>   2>    at java.base/sun.security.provider.SecureRandom.<init>(SecureRandom.java:79)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom.<init>(Unknown Source)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
>   2>    at java.base/java.security.AccessController.doPrivileged(Native Method)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getDefaultEntropySource(Unknown Source)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getDefaultSecureRandom(Unknown Source)
>   2>    at org.bouncycastle.jcajce.provider.ProvRandom$1.createInstance(Unknown Source)
>   2>    at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$BcService.newInstance(Unknown Source)
>   2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
>   2>    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
>   2>    at java.base/java.security.SecureRandom.getInstance(SecureRandom.java:364)
>   2>    at java.base/java.security.SecureRandom.getDefaultPRNG(SecureRandom.java:272)
>   2>    at java.base/java.security.SecureRandom.<init>(SecureRandom.java:218)
>   2>    at java.base/java.io.File$TempDirectory.<clinit>(File.java:1916)
>   2>    at java.base/java.io.File.createTempFile(File.java:2076)
>   2>    at com.sun.jna.Native.extractFromResourcePath(Native.java:1059)
>   2>    at com.sun.jna.Native.loadNativeDispatchLibraryFromClasspath(Native.java:937)
>   2>    at com.sun.jna.Native.loadNativeDispatchLibrary(Native.java:922)
>   2>    at com.sun.jna.Native.<clinit>(Native.java:190)
>   2>    at java.base/java.lang.Class.forName0(Native Method)
>   2>    at java.base/java.lang.Class.forName(Class.java:315)
>
>
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Tuesday, April 16, 2019 12:28 PM, Ioannis Kakavas <ikakavas-g/[email protected]> wrote:
>
>> Hi there folk,
>>
>> Would you mind sharing your plans if any, regarding the availability of the BouncyCastleFipsProvider for JDK11 ?
>>
>> I can see in the roadmap [1] that 1.0.2 which is the next release, is tested against JDK11, but I'm wondering if you plan to release the provider in a way that can be installed and used with JDK11 as there doesn't seem to currently be a way.
>>
>> -   > JDK9 removed the extension mechanism by which external jars could be placed in jre/lib/ext. This has been one of the common ways to configure the BouncyCastleFipsProvider statically. Would you plan to release the Provider as a module instead? Granted, this can be easily overcome by adding the bc-fips jar in the classpath of the application.
>>
>>
>> -   Also, with JDK9 the ability to pass extra parameters to the Security Providers on load time was removed as well. (Related issue that refers to the behavior change: [2]). This, however, is the only available way to configure SunJSSE or BCJSSE to use the BCFIPS provider, and as such put the JSSE provider in FIPS Mode [3]. Would you plan to release a BCJSSE Procider that is pre-configured in FIPS mode?
>>
>>     Best Regards
>>     Ioannis
>>
>>     [1] https://www.bouncycastle.org/fips_java_roadmap.html
>>     [2] https://bugs.openjdk.java.net/browse/JDK-8217907
>>     [3] https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.7.pdf
>>
>
>
>