IV27267: CLASS COM.IBM.CRYPTO.HDWRCCA.PROVIDER.WRAPPERKEY IS INCORRECTLY ALLOWED TO WRAP A PRIVATE KEY OF INSTANCE COM.IBM.CRYPTO.HDWRCCA
Closed as program error.
Error Message: No visible error messages are seen. . Stack Trace: N/A .
Application code that constructs a new com.ibm.crypto.hdwrCCA.provider.WrapperKey class can be modified to avoid ambiguous behavior. When constructing a WrapperKey class the instance of the private key used must not be com.ibm.crypto.hdwrCCA.provider.DSAPrivateHWKey or com.ibm.crypto.hdwrCCA.provider.RSAPrivateHWKey classes.
When using the com.ibm.crypto.hdwrCCA.provider.WrapperKey class to migrate a key object to the IBMJCECCA hardware environment the hardware attributes are only associated with a private key in the case where the key was not already an instance of the com.ibm.crypto.hdwrCCA.provider.RSAPrivateHWKey or com.ibm.crypto.hdwrCCA.provider.DSAPrivateHWKey classes. When using the com.ibm.crypto.hdwrCCA.provider.DSAPrivateHWKey or com.ibm.crypto.hdwrCCA.provider.RSAPrivateHWKey types of keys the hardware attributes were not associated with the key object since these instances of key objects are already bound to the hardware and the IBMJCECCA provider. This behavior provided an incorrect sense of having a set of hardware attributes associated with a key.
This defect will be fixed in: 5.0.0 SR15 . Logic was added to the com.ibm.crypto.hdwrCCA.provider.WrapperKey class to restrict what types of keys may be used on its constructor. The com.ibm.crypto.hdwrCCA.provider.DSAPrivateHWKey and com.ibm.crypto.hdwrCCA.provider.RSAPrivateHWKey types of keys are no longer permitted to be used with the com.ibm.crypto.hdwrCCA.provider.WrapperKey class constructor and an exception will be thrown. With the installation of this APAR customers may experience an exception being thrown that is an instance of the Exception class and will contain the message "Cannot construct a WrapperKey from a RSAPrivateHWKey. RSAPrivateHWKey already bound to the hardware." The Java environment variable ibm.ibmjcecca.allowwrapperhwkey is being made available to allow the JVM to fallback to prior invalid behavior when set to true. This option has been made available until user applications can be updated to handle the new exception being thrown, or pass non hardware bound key material to the com.ibm.crypto.hdwrCCA.provider.WrapperKey constructor. To set this environment variable specify the -D option on the java command line similar to the following example "java -Dibm.ibmjcecca.allowwrapperhwkey=true <Application>" It is strongly recommended to only use the fallback option for a limited time, until applications are modified to handle the exception. This new option is only a temporary mechanism and will be removed in a future service refresh. Users of the fallback option will be exposed to the same security vulnerability which existed prior to this APAR.
Reported component name
JAVA 5 SECURITY
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name
JAVA 5 SECURITY
Fixed component ID
Applicable component levels