Re: AW: Does BC actually provide cipher suites unavailable in Java 7?

You could try something like this: 

BouncyCastleJsseProvider provider = new BouncyCastleJsseProvider(new BouncyCastleProvider()); 
SSLContext sslContext = SSLContext.getInstance("TLS", provider); 
sslContext.init(null, null, new SecureRandom()); 
SSLSocketFactory fact = sslContext.getSocketFactory(); 
HttpsURLConnection conn = (HttpsURLConnection) new URL("https://[URL_THAT_REQUIRES_YOUR_CIPHERS]").openConnection(); 
conn.setSSLSocketFactory(fact); 
conn.connect(); 
InputStream is = conn.getInputStream(); 

this should bypass all of the JRE default initialization logic and give you a BC powered SSLContext to work with, the URL connection is actually just a quick way to test it actually works, I've been able to get a working connection with JRE 1.6 using this method while the OutOfTheBox implementation was unable to connect to the very same URL. 

Regards 
Luca Mambretti 

Da: "Eckenfels. Bernd" <[email protected]> 
A: [email protected] 
Inviato: Lunedì, 1 luglio 2019 16:27:50 
Oggetto: [dev-crypto] AW: Does BC actually provide cipher suites unavailable in Java 7? 



Hello, 



IMHO you cannot add new ciphers to the existing JSSE provider (you can only replace existing implementations). So when you want to use BC for new ciphers you will also have to switch to the SSL implementations of BC. 



Gruss 

Bernd 




Von: DiBaggio, Michael <[email protected]> 
Gesendet: Montag, 1. Juli 2019 16:14 
An: [email protected] 
Betreff: [dev-crypto] Does BC actually provide cipher suites unavailable in Java 7? 




Hi everyone. I haven’t pestered this list with my questions for several years, but I’m in a bind again. 



I am supporting a product that, for now, is absolutely restricted to Java 7. However, we have an application that connects to NetSuite, and about a week ago, NetSuite stopped allowing access to any of the ciphersuites we support out of the box. 



The ones we need to support are: 

    * ECDHE-RSA-AES128-GCM-SHA256 
    * ECDHE-RSA-AES256-GCM-SHA384 
    * AES128-GCM-SHA256 
    * AES256-GCM-SHA384 


None of which are available in Java 7. 



I copied the latest BCprov and BCtls jars into my jre/lib/ext, updated the java.security to list org.bouncycastle.jce.provider.BouncyCastleProvider and org.bouncycastle.jsse.provider.BouncyCastleJsseProvider as my first and second providers, and loaded the unlimited strength crypto policy jars. I then added the following arguments when I launch the application: 

-Dhttps.protocols=TLSv1.2 

-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 



But I get an “unsupported cipher” exception. 



So now I’m wondering if BC will actually provide ciphers it knows about if the underlying JRE doesn’t support them. On the other hand, if it is possible, I would appreciate some advice. 



Regards, 

Mike 

	
	
	
	
	

Michael ​ 	

	

DiBaggio 
	
	
	

Cleo 	

| 	

Sr Software Engineer II 
	
	
	
	
	

	

	


	
	
	

Email: 	

[ mailto:[email protected] | [email protected] ] 
	

| 	

Web: 	

[ https://www.cleo.com/ | www.cleo.com ] 
	
	

	


	

	


	
	

[ https://www.cleo.com/cleo-connect | Join us for Cleo Connect 2019, October 7-10 in Orlando!  Register today! ] 
	


	










			


	SEEBURGER AG 		Vorstand/SEEBURGER Executive Board: 
	Sitz der Gesellschaft/Registered Office: 		Axel Haas, Michael Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias Feßenbecker 
	Edisonstr. 1 		
	D-75015 Bretten 		Vorsitzende des Aufsichtsrats/Chairperson of the SEEBURGER Supervisory Board: 
	Tel.: 07252 / 96 - 0 		Prof. Dr. Simone Zeuchner 
	Fax: 07252 / 96 - 2222 		
	Internet: http://www.seeburger.de 		Registergericht/Commercial Register: 
	e-mail: [email protected] 		HRB 240708 Mannheim 




Dieses E-Mail ist nur für den Empfänger bestimmt, an den es gerichtet ist und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes Material enthalten. Jegliche darin enthaltene Ansicht oder Meinungsäußerung ist die des Autors und stellt nicht notwendigerweise die Ansicht oder Meinung der SEEBURGER AG dar. Sind Sie nicht der Empfänger, so haben Sie diese E-Mail irrtümlich erhalten und jegliche Verwendung, Veröffentlichung, Weiterleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengstens untersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd) übernehmen die Haftung für Viren; es obliegt Ihrer Verantwortung, die E-Mail und deren Anhänge auf Viren zu prüfen. 



This email is intended only for the recipient(s) to whom it is addressed. This email may contain confidential material that may be protected by professional secrecy. Any fact or opinion contained, or expression of the material herein, does not necessarily reflect that of SEEBURGER AG. If you are not the addressee or if you have received this email in error, any use, publication or distribution including forwarding, copying or printing is strictly prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels. Bernd) accept liability for viruses; it is your responsibility to check this email and its attachments for viruses.