PM06476: BADPADDINGEXCEPTION WHEN CHANGE KEYSTORE PASSWORD

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • Error Message: EKM will not start up, receiving the following
    error:
    .
    javax.crypto.BadPaddingException: Given final block not properly
    padded
    .at com.ibm.crypto.provider.AESCipher.engineDoFinal(Unknown
    Source)
    .at com.ibm.crypto.provider.AESCipher.engineDoFinal(Unknown
    Source)
    .at javax.crypto.Cipher.doFinal(Unknown Source)
    .at com.ibm.keymanager.keygroups.b.a.a(a.java:15)
    .
    .
    Stack Trace: N/A
    .
    When changing the keystore password in EKM using the following
    command in keytool:
    .
    keytool -storepasswd -v -all -new "xxxxxxxxxxxx" -keystore
    /u/ekm/EKMKeystore -storepass "yyyyyyyyyyyy" -storetype jceks
    .
    EKM will not start up, receiving the following error:
    

Local fix

  • Have changed back to old password temporarily
    

Problem summary

  • Password in KeyGroups.xml file also needs to be changed
    

Problem conclusion

  • This defect will be fixed in:
    5.0.0 SR11 FP2
    6.0.0 SR8
    1.4.2 SR13FP5
    .
    The EKM IPUG also needs modification.  In Chapter 3: "Installing
    the Encryption Key Manager and Keystores", under Main heading:
    "Generating Keys and Aliases for Encryption on LTO 4",  under
    Sub Heading: "Changing Keystore Passwords",  information in
    green as shown below needs to be added (information in blue
    below is already present in the EKM IPUG).
    Changing Keystore Passwords
    Note: Once you have set the keystore password, do not change it
    unless it?s security has been breached. The passwords are
    obfuscated to eliminate any security exposure. Changing the
    keystore password requires that the password on every key in
    that keystore be changed individually using the following
    keytool command.
    To change the keystore password enter:
    keytool -keypasswd -keypass old_passwd -new new_passwd -alias
    alias -keystore keystorename -storetype keystoretype
    You must also edit KeyManagerConfig.properties to change the
    keystore password in every server configuration file property
    where it is specified using one of these methods:
    Delete the entire obfuscated password and allow the Encryption
    Key Manager to prompt on the next startup.
    Delete the entire obfuscated password and type the new password
    in the clear. It will be obfuscated on the next startup.
    If createkeygroup command had been run earlier to add keygroup
    entries in KeyGroups.xml file, you must also run the following
    command to update the EncryptionKey attribute in KeyGroups.xml
    file.
    java com.ibm.keymanager.tools.EKMKeyGroupKeyModifier  <Server
    Configuration Properties Filename >   <KeyGroup password>
     Server Configuration Properties Filename is the Server's
    Configuration Properties filename having updated keystore
    password.
     KeyGroup password is the password that was specified while
    running createkeygroup command.
    eg: java com.ibm.keymanager.tools.EKMKeyGroupKeyModifier
    KeyManagerConfig.properties  passphrase
    .
    To obtain the fix:
    Install build 20100205 or later
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM06476

  • Reported component name

    JAVA(1.3/1.4 CO

  • Reported component ID

    5648C9800

  • Reported release

    42A

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2010-02-01

  • Closed date

    2010-04-22

  • Last modified date

    2010-06-20

  • APAR is sysrouted FROM one or more of the following:

    IZ68881

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    JAVA(1.3/1.4 CO

  • Fixed component ID

    5648C9800

Applicable component levels

  • R42A PSN

       UP

  • R42L PSN

       UP

  • R42W PSN

       UP

  • R420 PSN

       UP



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

z/OS family

Software version:

1.4.2

Reference #:

PM06476

Modified date:

2010-06-20

Translate my page

Machine Translation

Content navigation