andreaceccanti
commented
5 years ago Hi @paulmillar , is this issue still bugging you?
Open paulmillar opened 6 years ago
andreaceccanti
commented
5 years ago Hi @paulmillar , is this issue still bugging you?
paulmillar
commented
5 years ago Well, yes.
I'm currently using a work-around: voms-proxy-init2 (the C-client) works:
paul@celebrimbor:~$ voms-proxy-init2
Enter GRID pass phrase:
Your identity: /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar
Creating proxy ...................... Done
Your proxy is valid until Sat Feb 23 01:47:40 2019
paul@celebrimbor:~$ However, the Java client continues to be completely useless for me:
paul@celebrimbor:~$ voms-proxy-init3
Enter GRID pass phrase for this identity:
Credentials couldn't be loaded [/home/paul/.globus/userkey.pem, /home/paul/.globus/usercert.pem]: Error decrypting private key: the password is incorrect or the PEM data is corrupted.
No credentials found!
paul@celebrimbor:~$ For reference, these are the versions I have installed:
paul@celebrimbor:~$ dpkg-query -W|grep voms-client
voms-clients 2.1.0~rc0-2
voms-clients-java 3.0.7-1
paul@celebrimbor:~$ Hi Paul,
as you see from the stack trace
Credentials couldn't be loaded [/home/paul/.globus/userkey.pem, /home/paul/.globus/usercert.pem]: Error decrypting private key: the password is incorrect or the PEM data is corrupted.
java.io.IOException: Error decrypting private key: the password is incorrect or the PEM data is corrupted.
at eu.emi.security.authn.x509.impl.CertificateUtils.convertToPrivateKey(CertificateUtils.java:286)voms-clients relies on CANL to load credentials (which relies on Bouncycastle). This seems to be a problem in bouncycastle when decyphering keys issued by openssl 1.1.x:
https://github.com/bcgit/bc-java/issues/400
Taking inspiration from the issue above, I reproduced the issue as follows:
# openssl version
OpenSSL 1.1.1a 20 Nov 2018
# openssl genrsa -out key.pem 2048
# openssl pkcs8 -topk8 -inform PEM -in key.pem -out testkey-1.1.pem
...
$ openssl version
OpenSSL 1.0.2q 20 Nov 2018
$ openssl genrsa -out key.pem 2048
$ openssl pkcs8 -topk8 -inform PEM -in key.pem -out testkey-1.0.2.pemAnd then with this small program:
public class TestPrivateKeyParsing {
public static void main(String[] args) throws IOException {
FileInputStream key1_0 = new FileInputStream("testkey-1.0.2.pem");
FileInputStream key1_1 = new FileInputStream("testkey-1.1.pem");
PasswordSupplier ps = () -> "pippo".toCharArray();
CertificateUtils.loadPEMPrivateKey(key1_0,ps);
System.out.println("key_1_0 loaded succesfully");
CertificateUtils.loadPEMPrivateKey(key1_1,ps);
System.out.println("key_1_1 loaded succesfully");
}
}which prints on my machine:
key_1_0 loaded succesfully
Exception in thread "main" java.io.IOException: Error decrypting private key: the password is incorrect or the PEM data is corrupted.
at eu.emi.security.authn.x509.impl.CertificateUtils.convertToPrivateKey(CertificateUtils.java:286)
at eu.emi.security.authn.x509.impl.CertificateUtils.internalLoadPK(CertificateUtils.java:271)
at eu.emi.security.authn.x509.impl.CertificateUtils.loadPEMPrivateKey(CertificateUtils.java:242)
at it.infn.mw.iam.test.TestPrivateKeyParsing.main(TestPrivateKeyParsing.java:20)
Caused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: javax.crypto.BadPaddingException: pad block corrupted
at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)
at eu.emi.security.authn.x509.impl.CertificateUtils.resolvePK(CertificateUtils.java:306)
at eu.emi.security.authn.x509.impl.CertificateUtils.convertToPrivateKey(CertificateUtils.java:280)
... 3 more
Caused by: java.io.IOException: javax.crypto.BadPaddingException: pad block corrupted
at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:128)
at javax.crypto.CipherInputStream.read(CipherInputStream.java:246)
at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
at org.bouncycastle.util.io.Streams.readAll(Unknown Source)
... 6 more
Caused by: javax.crypto.BadPaddingException: pad block corrupted
at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher$BufferedGenericBlockCipher.doFinal(Unknown Source)
at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
at javax.crypto.Cipher.doFinal(Cipher.java:2047)
at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:125)
... 9 more@golbi also probably should have a look...
paulmillar
commented
5 years ago This issue has become pressing, as there are now VOMS servers that no longer work with the C-client (voms-proxy-init2). The IAM VOMS server is an example of such a VOMS server. The C-client fails when requesting the AC from such a server.
Via email, Andrea pointed out two work-arounds for this issue:
First, generate the proxy (without any VOMS AC):
paul@celebrimbor:~$ voms-proxy-init2
Enter GRID pass phrase:
Your identity: /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar
Creating proxy ...................................................... Done
Your proxy is valid until Fri Aug 9 01:44:30 2019Then use the Java-client to add the VOMS AC to the proxy:
paul@celebrimbor:~$ voms-proxy-init3 --voms escape --noregen
Contacting voms-escape.cloud.cnaf.infn.it:15000 [/DC=org/DC=terena/DC=tcs/C=IT/L=Frascati/O=Istituto Nazionale di Fisica Nucleare/CN=voms-escape.cloud.cnaf.infn.it] "escape"...
Remote VOMS server contacted succesfully.
WARNING: proxy lifetime limited to issuing credential lifetime.
Created proxy in /tmp/x509up_u1000.
Your proxy is valid until Fri Aug 09 01:44:30 CEST 2019paul@celebrimbor:~$ openssl rsa -in ~/.globus/original-key.pem -des3 -out ~/.globus/userkey.pem
Enter pass phrase for /home/paul/.globus/GridKa-paulmillar-2019-key.pem:
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Here is
voms-proxy-initnot working:This is actually
voms-proxy-inti3:Here are other tools successfully creating a proxy from the same EEC:
Here are some environment details:
Since the error message doesn't really say what went wrong (perhaps another bug, there), I took the current versions of libraries (available through Debian stretch) and added some simple debugging:
Here is the output of
voms-proxy-initwhen run with these patched libraries:Here's a rough summary of the credentials:
I've configured my laptop to use
voms-proxy-init2as a work-around, so this isn't urgent