RE: Does BC actually provide cipher suites unavailable in Java 7?

Thanks to all who replied with suggestions. We were able to get this working, although it required a code change to explicitly pass in the BC JSSEProvider to the SSLContext.

Mike


Michael 
DiBaggio
Cleo  |  
Sr Software Engineer II
Email: [email protected]
  |  
Web: www.cleo.com
Join us for Cleo Connect 2019, October 7-10 in Orlando!  Register today!
-----Original Message-----
From: Peter Dettman <[email protected]> 
Sent: Monday, July 1, 2019 11:16 AM
To: [email protected]
Subject: Re: [dev-crypto] Does BC actually provide cipher suites unavailable in Java 7?

Hi Michael,

Responses inline:

On 1/7/19 9:14 pm, DiBaggio, Michael wrote:
> Hi everyone. I haven’t pestered this list with my questions for 
> several years, but I’m in a bind again.
> 
> I am supporting a product that, for now, is absolutely restricted to 
> Java 7. However, we have an application that connects to NetSuite, and 
> about a week ago, NetSuite stopped allowing access to any of the 
> ciphersuites we support out of the box.
> 
> The ones we need to support are:
> 
>   * ECDHE-RSA-AES128-GCM-SHA256
>   * ECDHE-RSA-AES256-GCM-SHA384
>   * AES128-GCM-SHA256
>   * AES256-GCM-SHA384
> 
> None of which are available in Java 7.

BCJSSE supports the first two; the last 2 are TLS 1.3 ciphers which we don't support yet (TLS 1.3 that is). BCJSSE and all its implemented ciphersuites support Java versions back to Java 5.


> I copied the latest BCprov and BCtls jars into my jre/lib/ext, updated 
> the java.security to list 
> org.bouncycastle.jce.provider.BouncyCastleProvider and 
> org.bouncycastle.jsse.provider.BouncyCastleJsseProvider as my first 
> and second providers, and loaded the unlimited strength crypto policy jars.
> I then added the following arguments when I launch the application:
> 
> -Dhttps.protocols=TLSv1.2
> -Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

So these are intended to configure HttpsURLConnection? BCJSSE should be fine with those settings, but note that BCJSSE itself is not the code that processes those properties.


> But I get an “unsupported cipher” exception.

Please provide the stack trace of this exception.

I would guess that the HTTPS code isn't actually selecting BCJSSE for some reason. I would suggest debugging into HttpsURLConnection to find out how it's setting up an SSLContext and whether (or why not) it's finding BCJSSE.


> So now I’m wondering if BC will actually provide ciphers it knows 
> about if the underlying JRE doesn’t support them. On the other hand, 
> if it is possible, I would appreciate some advice.

Yes, all BCJSSE ciphersuites are implemented internally and do not rely on the underlying JRE. Available ciphersuites are in theory constrained by the cryptographic primitives available in your configured providers, but the BC provider supplies all of them in any case.

Regards,
Pete Dettman