Re: Does BC actually provide cipher suites unavailable in Java 7?

Hi Michael,

Responses inline:

On 1/7/19 9:14 pm, DiBaggio, Michael wrote:
> Hi everyone. I haven’t pestered this list with my questions for several
> years, but I’m in a bind again.
> 
> I am supporting a product that, for now, is absolutely restricted to
> Java 7. However, we have an application that connects to NetSuite, and
> about a week ago, NetSuite stopped allowing access to any of the
> ciphersuites we support out of the box.
> 
> The ones we need to support are:
> 
>   * ECDHE-RSA-AES128-GCM-SHA256
>   * ECDHE-RSA-AES256-GCM-SHA384
>   * AES128-GCM-SHA256
>   * AES256-GCM-SHA384
> 
> None of which are available in Java 7.

BCJSSE supports the first two; the last 2 are TLS 1.3 ciphers which we
don't support yet (TLS 1.3 that is). BCJSSE and all its implemented
ciphersuites support Java versions back to Java 5.


> I copied the latest BCprov and BCtls jars into my jre/lib/ext, updated
> the java.security to list
> org.bouncycastle.jce.provider.BouncyCastleProvider and
> org.bouncycastle.jsse.provider.BouncyCastleJsseProvider as my first and
> second providers, and loaded the unlimited strength crypto policy jars.
> I then added the following arguments when I launch the application:
> 
> -Dhttps.protocols=TLSv1.2
> -Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

So these are intended to configure HttpsURLConnection? BCJSSE should be
fine with those settings, but note that BCJSSE itself is not the code
that processes those properties.


> But I get an “unsupported cipher” exception.

Please provide the stack trace of this exception.

I would guess that the HTTPS code isn't actually selecting BCJSSE for
some reason. I would suggest debugging into HttpsURLConnection to find
out how it's setting up an SSLContext and whether (or why not) it's
finding BCJSSE.


> So now I’m wondering if BC will actually provide ciphers it knows about
> if the underlying JRE doesn’t support them. On the other hand, if it is
> possible, I would appreciate some advice.

Yes, all BCJSSE ciphersuites are implemented internally and do not rely
on the underlying JRE. Available ciphersuites are in theory constrained
by the cryptographic primitives available in your configured providers,
but the BC provider supplies all of them in any case.

Regards,
Pete Dettman