IJ21208: KDB to JKS keystore conversion creates JKS keystore with broken certificate chain, regression introduced in CMSProvider 2.63

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  workaround
  Regression introduced in CMSprovider release 2.63
  
  i) Workaround for Java8 version with IBMJCEPlus
  Include both IBMJCE and IBMJCEPlus provider in java.security
  file. i.e add the following lines
  security.provider.<N>=com.ibm.crypto.provider.IBMJCE
  security.provider.<N+1>=com.ibm.crypto.plus.provider.IBMJCEPlus
  
  ii) Workaround for other java versions (Java 7, etc)
  Please add the following lines to the code that is calling
  CMSProvider APIs:
  //get the JCEProvider and add some additional keys
  Provider jceProvider = Security.getProvider("IBMJCE");
  if (jceProvider != null) {
  jceProvider.put("Cipher.PBEWithSHAAnd3KeyTripleDESDeprecated",
  "com.ibm.security.cmskeystore.PBEWithSHAAnd3KeyTripleDESDeprecat
  edCipher");
  jceProvider.put("Alg.Alias.Cipher.1.2.840.113549.1.12.5.1.3",
  "PBEWithSHAAnd3KeyTripleDESDeprecated");
  jceProvider.put("SecretKeyFactory.PBEWithSHAAnd3KeyTripleDESDepr
  ecated",
  "com.ibm.security.cmskeystore.NonPrintableAsciiPBEKeyFactory");
  jceProvider.put("SecretKeyFactory.1.2.840.113549.1.12.5.1.3",
  "com.ibm.security.cmskeystore.NonPrintableAsciiPBEKeyFactory");
  

Local fix

Problem summary

• 1. KDB to JKS keystore conversion creates JKS keystore with
  broken certificate chain
  The problem is CMSProvider fails to locate the issue certificate
  and returns chain length as 1. CMSProvider uses the constructor
  X500Name(String dname) to locate the issuer certificate. The
  constructor encodes the issuer DN attributes (CN, OU, O, L, ST
  and C) as PrintableString (0x12) but the provider expects the DN
  attributes (OU, O, ST, C) in UTF8String (0x0C) format. This
  results in a mismatch in encoded value and a failure to locate
  the issuer certificate.
  
  2. Regression introduced in CMSprovider release 2.63
  CMSprovider fails to decrypt the private key with
  "NoSuchAlgorithmException". The problem is CMSProvider expects
  both IBMJCE and IBMJCEPlus provider in java.security file to add
  the following objects to the current JCEProvider
  (i) Cipher.1.2.840.113549.1.12.5.1.3 =
  com.ibm.security.cmskeystore.PBEWithSHAAnd3KeyTripleDESDeprecate
  dCipher and
  (ii) SecretKeyFactory.1.2.840.113549.1.12.5.1.3 =
  com.ibm.security.cmskeystore.NonPrintableAsciiPBEKeyFactory
  The above algorithms are required to handle non-printable
  characters in the password.
  The impact in the absence of the above algorithms in IBMJCE is
  that it can cause inter-operability issues such as iKeyman fails
  to decode certificates created with gsk8capicmd tool
  

Problem conclusion

• 1. KDB to JKS keystore conversion creates JKS keystore with
  broken certificate chain
  CMSprovider will use X509Certificate.getSubjectX500Principal()
  instead to rectify the mismatch in encoded String type.
  
  2. Regression introduced in CMSprovider release 2.63
  Fix CMSprovider to add the above algorithms (listed in
  problemSummary) if either IBMJCE or IBMJCEPlus provider is
  present in Java.security.
  
  .
  This APAR will be fixed in the following Java Releases:
     8    SR6 FP5   (8.0.6.5)
     7    SR10 FP60 (7.0.10.60)
     7 R1 SR4 FP60  (7.1.4.60)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels