IV77051: CIPHER MODES GCM/CFB/OFB FAIL USING IBMJCECCA CRYPTO PROVIDER ON Z13 WITH CEX5 CARD

APAR status

• Closed as program error.

Error description

• Error Message: A message reading "Requested cipher mode not
  supported in this environment." is reported in the stack trace
  to indicate that the requested cipher mode is not supported by
  the IBMJCECCA cryptographic provider.
  .
  Stack Trace: java.security.NoSuchAlgorithmException: No such
  algorithm: AES/GCM/PKCS5Padding
   at javax.crypto.Cipher.getInstance(Unknown Source)
   at javax.crypto.Cipher.getInstance(Unknown Source)
   at
  com.ibm.test.ibmjcecca.cipher.aesgcm.TestGCMGetInstance1.TestGCM
  getInstance103(TestGCMGetInstance1.java:143)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at
  sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
  Impl.java:95)
   at
  sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
  AccessorImpl.java:56)
   at java.lang.reflect.Method.invoke(Method.java:620)
   at
  org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(Fram
  eworkMethod.java:47)
   at
  org.junit.internal.runners.model.ReflectiveCallable.run(Reflecti
  veCallable.java:12)
   at
  org.junit.runners.model.FrameworkMethod.invokeExplosively(Framew
  orkMethod.java:44)
   at
  org.junit.internal.runners.statements.InvokeMethod.evaluate(Invo
  keMethod.java:17)
   at
  org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
   at
  org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4Cla
  ssRunner.java:70)
   at
  org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4Cla
  ssRunner.java:50)
   at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
   at
  org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
   at
  org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236
  )
   at
  org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
   at
  org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
   at
  org.junit.internal.runners.statements.RunBefores.evaluate(RunBef
  ores.java:26)
   at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
   at org.junit.runners.Suite.runChild(Suite.java:127)
   at org.junit.runners.Suite.runChild(Suite.java:26)
   at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
   at
  org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
   at
  org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236
  )
   at
  org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
   at
  org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
   at
  org.junit.internal.runners.statements.RunBefores.evaluate(RunBef
  ores.java:26)
   at
  org.junit.internal.runners.statements.RunAfters.evaluate(RunAfte
  rs.java:27)
   at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
   at
  junit.framework.JUnit4TestAdapter.run(JUnit4TestAdapter.java:38)
   at
  org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.run
  (JUnitTestRunner.java:532)
   at
  org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.lau
  nch(JUnitTestRunner.java:1179)
   at
  org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.mai
  n(JUnitTestRunner.java:1030)
  Caused by: java.security.NoSuchAlgorithmException: Requested
  cipher mode not supported in this environment.
   at
  com.ibm.crypto.hdwrCCA.provider.AESCipher.engineSetMode(AESCiphe
  r.java:1173)
   at javax.crypto.Cipher$a_.a(Unknown Source)
   ... 35 more
  .
  

Local fix

• There are no known workarounds for this problem.
  

Problem summary

• This problem is caused by the IBMJCECCA cryptographic provider
  incorrectly handling the status of the CEX5C card. This resulted
  in the IBMJCECCA cryptographic provider incorrectly turning off
  support for GCM, CFB, and OFB modes when used with a CEX5 card.
  

Problem conclusion

• The IBMJCECCA cryptographic provider has been modified to
  correctly work with the CEX5 card.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR2       (8.0.2.0)
     7 R1 SR3 FP20  (7.1.3.20)
     7    SR9 FP20  (7.0.9.20)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R270 PSY

     UP

• R260 PSY

     UP