IV96924: IBMPKCS11IMPL CRYPTO PROVIDER - EC PUBLIC KEY ENCODING

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  When the IBMPKCS11Impl provider generates an EC public key, the
  EC parameters within the key are represented as a collection of
  individual parameters even if those parameters are associated
  with a named curve.  When a user adds that EC public key to a
  PKCS#10 certificate request, some certificate authorities have
  trouble processing an EC public key of this form.
  

Local fix

Problem summary

• When the IBMPKCS11Impl provider generates an EC public key, the
  EC parameters within the key are represented as a collection of
  individual parameters even if those parameters are associated
  with a named curve.  When a user adds that EC public key to a
  PKCS#10 certificate request, some certificate authorities have
  trouble processing an EC public key of this form.
  

Problem conclusion

• Updates have been made to supporting PKCS classes that will
  cause EC parameters within a PKCS#11 EC public key to be
  represented by the OID of the associated named curve, if any.
  The OID will be handled more easily by certificate authorities
  that attempt to service certificate requests carrying EC public
  keys.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR4 FP10  (8.0.4.10)
     7    SR10 FP10 (7.0.10.10)
     6 R1 SR8 FP50  (6.1.8.50)
     6    SR16 FP50 (6.0.16.50)
     7 R1 SR4 FP10  (7.1.4.10)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R270 PSY

     UP

• R260 PSY

     UP

• R600 PSY

     UP