Re: BC FIPS provider got handshake errors for some FIPS mode cipher suites

Hi Jeff,
Perhaps you are running a server and only have RSA certificates
available in your key store, but since you've given next to no details
of what you're testing, it's just a guess.

- Which BC jars (and which versions) are being used?
- What does your provider configuration look like?
- Are you testing a client? a server? both?
- If you're only running one end, what software is at the other end? How
are you confining the test to a specific cipher suite?
- Standalone test or is there a webserver or http client involved?
- What does "not working" mean? What test were you running and what was
the expected result? Did any errors appear in the logs?
- etc.

Regards,
Pete Dettman

On 30/10/19 5:45 am, Jeff Huang wrote:
> Hello,
> 
> The following cipher suites are FIPS mode based on "Appendix B – Supported
> Cipher Suites" in BC-FJA-(D)TLSUserGuide-1.0.9.pdf.
> 
> I got handshake errors for all cipher suites with DHE key exchange algorithm
> and all cipher suites with ECDHE key exchange algorithm and ECDSA
> authentication algorithm. 
> 
> *The following cipher suite are not working*
>  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,         
>  TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
>  TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
>  TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
>  TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
> 
> TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,       
> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
> 
> *The following cipher suites are working. *
> TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
> TLS_RSA_WITH_3DES_EDE_CBC_SHA,              
> TLS_RSA_WITH_AES_128_CBC_SHA,
> TLS_RSA_WITH_AES_128_CBC_SHA256,
> TLS_RSA_WITH_AES_128_CCM,                   
> TLS_RSA_WITH_AES_256_CBC_SHA,
> TLS_RSA_WITH_AES_256_CBC_SHA256,
> TLS_RSA_WITH_AES_256_CCM    
> 
> Is that right behavior? Or I missed something. I did both key manager
> algorithm and trust manager algorithm to PKIS, key store type is pkcs12.
> 
> Thanks!
> 
> Jeff. 
> 
> 
> 
> --
> Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html
>