Re: BC-FIPS does not reject JKS keystores

David Hook <dgh-rTAZ0PM/[email protected]> Fri, 15 Nov 2019 12:50:38 +1100
Newsgroups	gmane.comp.encryption.bouncy-castle.devel
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------CA9037C9E7501490C7662207
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit


The module can read JKS files which only contain certificates in
approved mode, but this does need to be especially configured. Where the
configuration does not allow for it (as seems to be the case below), the
module will not load a JKS key store. You might want to check what's
loading the keystores.

Regards,

David
On 14/11/19 11:01 pm, Daniel Jeliński wrote:
> Hi,
> After reading the docs (specifically
> https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf,
> page 69, appendix G, point 3) I'm under the impression that BC-FIPS
> should reject JKS keystores. However, I'm able to run Jetty using JKS
> keystores with no issues.
>
> I'm using AdoptOpenJDK's Java 8 with the following changes in
> java.security:
>
>     security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
>     C:HYBRID;ENABLE{ALL}
>     security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
>     fips:BCFIPS
>     security.provider.3=sun.security.provider.Sun
>     ssl.KeyManagerFactory.algorithm=X509
>
>
> I had to change KeyManagerFactory because the default SunX509 was not
> available with this provider list.
>
> I'm starting the application with
> -Dorg.bouncycastle.fips.approved_only=true, and
> CryptoServicesRegistrar.isInApprovedOnlyMode() returns true as expected.
>
> I'm using BC-FIPS 1.0.2, BCTLS-FIPS 1.0.9 and BCPKIX-FIPS 1.0.3
>
> Am I doing something wrong, or just misreading the docs?
> Thanks,
> Daniel



--------------CA9037C9E7501490C7662207
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">The module can read JKS files which
      only contain certificates in approved mode, but this does need to
      be especially configured. Where the configuration does not allow
      for it (as seems to be the case below), the module will not load a
      JKS key store. You might want to check what's loading the
      keystores.<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">Regards,</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">David<br>
    </div>
    <div class="moz-cite-prefix">On 14/11/19 11:01 pm, Daniel Jeliński
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAMrH03JKFajkfzttWGiHP-+uH0wVBSJsginrAgSkh1tnpOjObQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">Hi,<br>
        After reading the docs (specifically <a
href="https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf"
          moz-do-not-send="true">https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf</a>,
        page 69, appendix G, point 3) I'm under the impression that
        BC-FIPS should reject JKS keystores. However, I'm able to run
        Jetty using JKS keystores with no issues.<br>
        <br>
        I'm using AdoptOpenJDK's Java 8 with the following changes in
        java.security:<br>
        <blockquote style="margin:0 0 0 40px;border:none;padding:0px">security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
          C:HYBRID;ENABLE{ALL}<br>
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
          fips:BCFIPS<br>
          security.provider.3=sun.security.provider.Sun<br>
          ssl.KeyManagerFactory.algorithm=X509</blockquote>
        <br>
        I had to change KeyManagerFactory because the default SunX509
        was not available with this provider list.<br>
        <div><br>
        </div>
        <div>I'm starting the application with
          -Dorg.bouncycastle.fips.approved_only=true, and
          CryptoServicesRegistrar.isInApprovedOnlyMode() returns true as
          expected.
          <div><br>
          </div>
          <div>I'm using BC-FIPS 1.0.2, BCTLS-FIPS 1.0.9 and BCPKIX-FIPS
            1.0.3</div>
        </div>
        <div><br>
        </div>
        <div>Am I doing something wrong, or just misreading the docs?</div>
        <div>Thanks,</div>
        <div>Daniel</div>
      </div>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>

--------------CA9037C9E7501490C7662207--