Closed space88man closed 3 years ago
With JDK 11 , the error looks like:
$ java -cp lib/bcprov-jdk15on-1.66.jar -Djava.security.properties=bc.properties \
sun.security.tools.keytool.Main -v -keystore 0.p12 -storetype PKCS12 -storepass password \
-certreq -alias ecpair -file ecpair.req
keytool error: java.lang.UnsupportedOperationException
java.lang.UnsupportedOperationException
at java.base/java.security.SignatureSpi.engineGetParameters(SignatureSpi.java:405)
at java.base/java.security.Signature$Delegate.engineGetParameters(Signature.java:1453)
at java.base/java.security.Signature.getParameters(Signature.java:1029)
at java.base/sun.security.pkcs10.PKCS10.encodeAndSign(PKCS10.java:235)
at java.base/sun.security.tools.keytool.Main.doCertReq(Main.java:1578)
at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:1093)
at java.base/sun.security.tools.keytool.Main.run(Main.java:398)
at java.base/sun.security.tools.keytool.Main.main(Main.java:391)
...so the JDK folks must have switched to using Signature.getParameters()
in recent builds.
Possibly BC should return null
like SunEC (as it does for RSA in rsa/DigestSignatureSpi.java) ?
public final AlgorithmParameters getParameters()
Returns the parameters used with this signature object.
If this signature has been previously initialized with parameters (by calling the setParameter method),
this method returns the same parameters. If this signature has not been initialized with parameters,
this method may return a combination of default and randomly generated parameter values if the underlying
signature implementation supports it and can successfully generate them. Otherwise, null is returned.
Returns:
the parameters used with this signature, or null
Since:
1.4
See Also:
setParameter(AlgorithmParameterSpec)
I've modified this, and a few others to return null. Will be in 167b06 on https://www.bouncycastle.org/betas
Version: BouncyCastle 1.66 from maven central
JDK8u >= 252
sun.security.pkcs10.PKCS10
(used by keytool) has changed its implementation ofencodeAndSign
to callSignature.getParameters()
. BC will throw anUnsupportedOperationException
using the-certreq
subcommand with a EC keypair. In contrast, SunEC returnsnull
.This used to work with <= JDK8u242 (PKCS10.java did not use the method
Signature.getParameters()
)How to reproduce:
Create
bc.properties
file so BC replaces SunECCreate keypair:
Generate CSR
To correlate line numbers with source code: the specific JDK I am using is Fedora 32's java-1.8.0-openjdk-1.8.0.265.b01-1.fc32.x86_64, whose matching source is java-1.8.0-openjdk-src-1.8.0.265.b01-1.fc32.x86_64. The code snippet in question, which happened around u252 is:
Line 244: it's not handling the case where
getParameters()
throwsUnsupportedOperationException
.This can also be reproduced in JDK 11(java-11-openjdk-11.0.8.10-2.fc32.x86_6).
Note:
-genkeypair
signs the TBSCertificate structure, but never callsSignature.getParamemeters()
so key pair generation works.engineGetParameters()
is implemented inrsa/DigestSignatureSpi.java
to returnnull
, so RSA keys work