[JBoss JIRA] (ELY-1998) IllegalStateException: unable to create JcaTlsCrypto: DEFAULT SecureRandom not available when configuring BC FIPS on JDK 11
by Rich Lucente (Jira)
[ https://issues.redhat.com/browse/ELY-1998?page=com.atlassian.jira.plugin.... ]
Rich Lucente commented on ELY-1998:
-----------------------------------
I have not, it's been some time since I've looked at this. We do have a support agreement with bouncycastle (actually their CryptoWorkshop organization). Bilge should have info on how to reach out to them.
> IllegalStateException: unable to create JcaTlsCrypto: DEFAULT SecureRandom not available when configuring BC FIPS on JDK 11
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: ELY-1998
> URL: https://issues.redhat.com/browse/ELY-1998
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SSL
> Reporter: Diana Vilkolakova
> Priority: Major
>
> The below steps require ELY-1982 bugfix to work.
> Configure security providers in java.security file:
> {code}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
> security.provider.3=SUN
> {code}
> Add the bc-fips.jar and bctls-fips-1.0.10.jar to the CLASSPATH and generate keystore in JBOSS_HOME/standalone/configuration folder:
> {code}
> keytool -genkeypair -alias appserver -keyalg RSA -keysize 2048 -keypass password -keystore "fips.keystore" -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH -storetype BCFKS -storepass password -dname "CN=testserver,OU=TESTOU,O=TESTO,L=TESTL,ST=TESTCZ,C=TESTCZ" -validity 730 -v
> {code}
> Try to configure `server-ssl-context`:
> {code}
> module add --name=org.bouncycastle.fips --resources=/path/to/bc-fips-1.0.2.jar:/path/to/bctls-fips-1.0.10.jar
> /subsystem=elytron/provider-loader=bc:add(module=org.bouncycastle.fips)
> /subsystem=elytron/key-store=fipsKS:add(path=fips.keystore, relative-to=jboss.server.config.dir, credential-reference={clear-text=password}, type="BCFKS", providers=bc)
> /subsystem=elytron/key-manager=fipsKM:add(key-store=fipsKS, algorithm="X509", credential-reference={clear-text=password}, providers=bc)
> /subsystem=elytron/server-ssl-context=fipsSSC:add(key-manager=fipsKM, protocols=["TLSv1.2"], providers=bc)
> {code}
> The last command results in:
> {code}
> {
> "outcome" => "failed",
> "failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.fipsSSC" => "Failed to start service
> Caused by: java.lang.IllegalStateException: unable to create JcaTlsCrypto: DEFAULT SecureRandom not available
> Caused by: java.security.NoSuchAlgorithmException: DEFAULT SecureRandom not available"}},
> "rolled-back" => true
> }
> {code}
> The exception is happening [on this line|https://github.com/Skyllarr/wildfly-elytron/blob/ELY-1982/ssl/src/ma...] . This exception can be avoided by either using *new SecureRandom()* instead of null during initialization of sslContext, or by configuring securerandom with using *CryptoServicesRegistrar.setSecureRandom(new SecureRandom());* in code beforehand (this would require bc dependency).
> I tried to configure secure random statically by setting *securerandom.strongAlgorithms=DEFAULT:BCFIPS* in java.security or by trying to pass secure random as parameter to constructor with
> {code}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider "C:DEFRND[SHA512];ENABLE{ALL};"
> {code}
> but neither had any effect. I did not find how to configure this statically for Java 11 in BC documentation.
> We could pass new instance of SecureRandom when initializing sslContext (if bouncycastle is used), or set secureRandom beforehand, or catch this exception and then use `new SecureRandom()`. But should we force the users to use SecureRandom set in the code by us? If users want to use Bouncycastle they should configure the secure random themselves since it is needed by the provider?
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 6 months
[JBoss JIRA] (WFLY-13585) Add a Galleon layer for JSON-P
by Yeray Borges Santana (Jira)
[ https://issues.redhat.com/browse/WFLY-13585?page=com.atlassian.jira.plugi... ]
Yeray Borges Santana updated WFLY-13585:
----------------------------------------
Summary: Add a Galleon layer for JSON-P (was: Add a Galleon layer for JSONP )
> Add a Galleon layer for JSON-P
> -------------------------------
>
> Key: WFLY-13585
> URL: https://issues.redhat.com/browse/WFLY-13585
> Project: WildFly
> Issue Type: Feature Request
> Components: Build System
> Reporter: Yeray Borges Santana
> Assignee: Yeray Borges Santana
> Priority: Major
>
> Create a Galleon layer to provision JsonP API and Impl modules. These modules already belong to the base server, so the idea with this layer is just to ensure they are provisioned independently if they are excluded in the future from the base-server layer.
>
>
>
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 6 months