IV89825: MISMATCH IN RECORDID AND MORE SECURED STASH FILE FORMAT

APAR status

• Closed as program error.

Error description

• Error Message: 1. Mismatch in recordID:
  Record ID mismatch between encoded and unencoded part causes
  cert creation in gsk8capicmd to fail with cause "Duplicate
  record ID".
  2. New stash File format:
  A new requirement to support a more secured stash file.
  .
  Stack Trace: N/A
  .
  

Local fix

• Workaround for mismatch in record ID: Remove '-default_cert'
  flag during certificate creation via CLI as this is the root
  cause of mismatch in record ID in iKeyman.
  

Problem summary

• 1. Mismatch in recordID:
  Record ID mismatch between encoded and unencoded part causes
  cert creation in gsk8capicmd to fail with error
  'GSKKM_ERR_DATABASE_DUPLICATE_KEY_RECORD_ID'.
  2. New stash File format:
  Requirement for a more secured stash file and additionally the
  older stash format should still be supported.
  

Problem conclusion

• 1. Mismatch in recordID:
  Mismatch in record ID is caused only when -default_cert
  parameter is used in cert creation. For default certifcate, CMS
  Provider overwrites the previous entry but fails to correct the
  recordID in the unencoded part. Bug is fixed in this release.
  2. New stash File format:
  1. A more secured stash file will be generated.
  2. A new parameter tag -v1stash is used, to generate stash file
  in its legacy format (legacy stash file format is less secured
  and not recommended)
  3. -v1stash can also be set using the new system property
  DEFAULT_PASSWORD_V1STASHING_STATE.
  .
  This APAR will be fixed in the following Java Releases:
     7 R1 SR3 FP60  (7.1.3.60)
     7    SR9 FP60  (7.0.9.60)
     6    SR16 FP35 (6.0.16.35)
     8    SR3 FP20  (8.0.3.20)
     6 R1 SR8 FP35  (6.1.8.35)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP

• R600 PSY

     UP

• R270 PSY

     UP