IV35771: THE IBMPKCS11IMPL SECURITY SHOULD EXPAND ITS ALIAS DEFINITIONS F OR THE SHA*WITHECDSA SIGNATURE ALGORITHMS

APAR status

• Closed as program error.

Error description

• Error Message: A user observed that the SHA256withECDSA,
  SHA384withECDSA, and SHA512withECDSA signature algorithms
  supported by the IBMPKCS11Impl provider could not be referenced
  using either an alias string or an OID value.
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• A user observed that the SHA256withECDSA, SHA384withECDSA, and
  SHA512withECDSA signature algorithms supported by the
  IBMPKCS11Impl provider could not be referenced using either an
  alias string or an OID value.
  

Problem conclusion

• This defect will be fixed in:
  6.0.0 SR13
  6.0.1 SR5
  7.0.0 SR4
  .
  Support for the following alias strings were added  to the
  IBMPKCS11Impl security provider for these signature algorithms:
  For "SHA256withECDSA", the following alias strings can be used
  instead:
                  aliases = new String<OSB><CSB> {
                          "SHA2withECDSA",
                          "SHA2/ECDSA",
                          "OID.1.2.840.10045.4.3.2",
                          "1.2.840.10045.4.3.2"
                  };
  For SHA384withECDSA the following aliases can be used:
  
                  aliases = new String<OSB><CSB> {
                          "SHA3withECDSA",
                          "SHA3/ECDSA",
                          "OID.1.2.840.10045.4.3.3",
                          "1.2.840.10045.4.3.3"
                  };
  For SHA512withECDSA the following aliases can be used:
  
                  aliases = new String<OSB><CSB> {
                          "SHA5withECDSA",
                          "SHA5/ECDSA",
                          "OID.1.2.840.10045.4.3.4",
                          "1.2.840.10045.4.3.4"
                  };
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R600 PSY

     UP

• R260 PSY

     UP