Re: BC-FIPS does not reject JKS keystores

--000000000000ec56b505975e1226
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks David for your response.
I tried with -Dorg.bouncycastle.jca.enable_jks=3Dtrue, which failed as
expected. Without this setting JKS keystores are loaded by
sun.security.provider.Sun, which is recommended by user guide.

Anyway, I found the exception. After a long fight with
https://github.com/bcgit/bc-java/issues/604 I decided to try out
com.sun.net.ssl.internal.ssl.Provider instead
of org.bouncycastle.jsse.provider.BouncyCastleJsseProvider, and got this:

java.security.KeyStoreException: FIPS mode: KeyStore must be from provider
BCFIPS
at
sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactory=
Impl.java:67)
at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:256)


So, all is good. I'd just like to know which JSSE provider was BouncyCastle
approved with, Sun's or BouncyCastleJsseProvider?
Thanks,
Daniel


pt., 15 lis 2019 o 02:51 David Hook <dgh-rTAZ0PM/[email protected]> napisa=C5=82(a=
):

>
> The module can read JKS files which only contain certificates in approved
> mode, but this does need to be especially configured. Where the
> configuration does not allow for it (as seems to be the case below), the
> module will not load a JKS key store. You might want to check what's
> loading the keystores.
>
> Regards,
>
> David
> On 14/11/19 11:01 pm, Daniel Jeli=C5=84ski wrote:
>
> Hi,
> After reading the docs (specifically
> https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf,
> page 69, appendix G, point 3) I'm under the impression that BC-FIPS shoul=
d
> reject JKS keystores. However, I'm able to run Jetty using JKS keystores
> with no issues.
>
> I'm using AdoptOpenJDK's Java 8 with the following changes in
> java.security:
>
> security.provider.1=3Dorg.bouncycastle.jcajce.provider.BouncyCastleFipsPr=
ovider
> C:HYBRID;ENABLE{ALL}
> security.provider.2=3Dorg.bouncycastle.jsse.provider.BouncyCastleJsseProv=
ider
> fips:BCFIPS
> security.provider.3=3Dsun.security.provider.Sun
> ssl.KeyManagerFactory.algorithm=3DX509
>
>
> I had to change KeyManagerFactory because the default SunX509 was not
> available with this provider list.
>
> I'm starting the application with
> -Dorg.bouncycastle.fips.approved_only=3Dtrue, and
> CryptoServicesRegistrar.isInApprovedOnlyMode() returns true as expected.
>
> I'm using BC-FIPS 1.0.2, BCTLS-FIPS 1.0.9 and BCPKIX-FIPS 1.0.3
>
> Am I doing something wrong, or just misreading the docs?
> Thanks,
> Daniel
>
>
>

--000000000000ec56b505975e1226
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks David for your response.<div>I tried with=C2=A0-Dor=
g.bouncycastle.jca.enable_jks=3Dtrue, which failed as expected. Without thi=
s setting JKS keystores are loaded by sun.security.provider.Sun, which is r=
ecommended by user guide.</div><div><br></div><div>Anyway, I found the exce=
ption. After a long fight with=C2=A0<a href=3D"https://github.com/bcgit/bc-=
java/issues/604">https://github.com/bcgit/bc-java/issues/604</a>=C2=A0I dec=
ided to try out com.sun.net.ssl.internal.ssl.Provider instead of=C2=A0org.b=
ouncycastle.jsse.provider.BouncyCastleJsseProvider, and got this:</div><blo=
ckquote style=3D"margin:0 0 0 40px;border:none;padding:0px"><div>java.secur=
ity.KeyStoreException: FIPS mode: KeyStore must be from provider BCFIPS</di=
v><div>	at sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyMan=
agerFactoryImpl.java:67)</div><div>	at javax.net.ssl.KeyManagerFactory.init=
(KeyManagerFactory.java:256)</div></blockquote><div><br></div><div>So, all =
is good. I&#39;d just like to know which JSSE provider was BouncyCastle app=
roved with, Sun&#39;s or=20

BouncyCastleJsseProvider?</div><div>Thanks,</div><div>Daniel</div><div><br>=
</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_=
attr">pt., 15 lis 2019 o 02:51=C2=A0David Hook &lt;<a href=3D"mailto:dgh@cr=
yptoworkshop.com">dgh-rTAZ0PM/[email protected]</a>&gt; napisa=C5=82(a):<br></div>=
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
 =20
   =20
 =20
  <div bgcolor=3D"#FFFFFF">
    <div><br>
    </div>
    <div>The module can read JKS files which
      only contain certificates in approved mode, but this does need to
      be especially configured. Where the configuration does not allow
      for it (as seems to be the case below), the module will not load a
      JKS key store. You might want to check what&#39;s loading the
      keystores.<br>
    </div>
    <div><br>
    </div>
    <div>Regards,</div>
    <div><br>
    </div>
    <div>David<br>
    </div>
    <div>On 14/11/19 11:01 pm, Daniel Jeli=C5=84ski
      wrote:<br>
    </div>
    <blockquote type=3D"cite">
     =20
      <div dir=3D"ltr">Hi,<br>
        After reading the docs (specifically <a href=3D"https://downloads.b=
ouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf" target=3D"_blank">htt=
ps://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf</a>,
        page 69, appendix G, point 3) I&#39;m under the impression that
        BC-FIPS should reject JKS keystores. However, I&#39;m able to run
        Jetty using JKS keystores with no issues.<br>
        <br>
        I&#39;m using AdoptOpenJDK&#39;s Java 8 with the following changes =
in
        java.security:<br>
        <blockquote style=3D"margin:0px 0px 0px 40px;border:none;padding:0p=
x">security.provider.1=3Dorg.bouncycastle.jcajce.provider.BouncyCastleFipsP=
rovider
          C:HYBRID;ENABLE{ALL}<br>
security.provider.2=3Dorg.bouncycastle.jsse.provider.BouncyCastleJsseProvid=
er
          fips:BCFIPS<br>
          security.provider.3=3Dsun.security.provider.Sun<br>
          ssl.KeyManagerFactory.algorithm=3DX509</blockquote>
        <br>
        I had to change KeyManagerFactory because the default SunX509
        was not available with this provider list.<br>
        <div><br>
        </div>
        <div>I&#39;m starting the application with
          -Dorg.bouncycastle.fips.approved_only=3Dtrue, and
          CryptoServicesRegistrar.isInApprovedOnlyMode() returns true as
          expected.
          <div><br>
          </div>
          <div>I&#39;m using BC-FIPS 1.0.2, BCTLS-FIPS 1.0.9 and BCPKIX-FIP=
S
            1.0.3</div>
        </div>
        <div><br>
        </div>
        <div>Am I doing something wrong, or just misreading the docs?</div>
        <div>Thanks,</div>
        <div>Daniel</div>
      </div>
    </blockquote>
    <p><br>
    </p>
  </div>

</blockquote></div>

--000000000000ec56b505975e1226--