Bug 1699068
| Summary: | Elliptic Curve secp256k1 is missing in java-11-openjdk-11.0.1.13-3.el7_6.x86_64 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | pbarate |
| Component: | java-11-openjdk | Assignee: | Andrew John Hughes <ahughes> |
| Status: | CLOSED ERRATA | QA Contact: | OpenJDK QA <java-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | ahughes, dbhole, jvanek, zzambers |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | java-11-openjdk-11.0.5.2-0.2.ea.el7 | Doc Type: | Enhancement |
| Doc Text: |
.OpenJDK now also supports secp256k1
Previously, Open Java Development Kit (OpenJDK) could only use curves from the NSS library. Consequently, OpenJDK provided only the secp256r1, secp384r1, and secp521r1 curves for elliptic curve cryptography (ECC). With this update, OpenJDK uses the internal ECC implementation and also supports the secp256k1 curve.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-31 19:57:27 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1656677 | ||
| Bug Blocks: | 1725255 | ||
Deferring to 7.8 as this will need time for a crypto & PELC review. Tested by https://github.com/judovana/CryptoTest/ Manual check for given explicit curve will be necessary With the revised removal patch (IcedTea PR3751), which retains ssecp256k1: $ /mnt/builder/shenandoah.11/images/jdk/bin/java Curves [[secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]] $ /mnt/builder/shenandoah.11/images/jdk/bin/java ECKeyPair Sun EC public key, 256 bits public x coord: 79523231440252223545206576613674799022307975635301802899245219154254251779667 public y coord: 73467828469929858295500430696061047515425097562480352925430311428120235169575 parameters: secp256k1 (1.3.132.0.10) $ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java -version openjdk version "11.0.5-ea" 2019-10-15 LTS OpenJDK Runtime Environment 18.9 (build 11.0.5-ea+2-LTS) OpenJDK 64-Bit Server VM 18.9 (build 11.0.5-ea+2-LTS, mixed mode) $ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java Curves [[secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]] $ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java ECKeyPair Sun EC public key, 256 bits public x coord: 38540685351311776496837147664686496462553578459953286438120003757034125588588 public y coord: 749815700193903859740125736338725457550786883309687499594725670082022165421 parameters: secp256k1 (1.3.132.0.10) Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1088 |
Description of problem: I have a customer who is using RHEL 7.6 and java-11-openjdk-11.0.1.13-3.el7_6.x86_64(which we ship through rpm). While trying to fetch elliptic curve secp256k1 using small java program it is giving the below error instead of returning elliptic curve secp256k1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [abc@abc]$ java ECKeypair.java Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1 at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103) at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699) at ECkeypair.main(ECKeypair.java:13) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When I am trying to run the programs mentioned in "Steps to Reproduce" using community version of Open JDK 11.0.2 General-Availability Release. I am getting below output and program works fine ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [abc@abc]$ java Curves.java [[secp112r1,1.3.132.0.6], [secp112r2,1.3.132.0.7], [secp128r1,1.3.132.0.28], [secp128r2,1.3.132.0.29], [secp160k1,1.3.132.0.9], [secp160r1,1.3.132.0.8], [secp160r2,1.3.132.0.30], [secp192k1,1.3.132.0.31], [secp192r1,NIST P-192,X9.62 prime192v1,1.2.840.10045.3.1.1], [secp224k1,1.3.132.0.32], [secp224r1,NIST P-224,1.3.132.0.33], [secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35], [X9.62 prime192v2,1.2.840.10045.3.1.2], [X9.62 prime192v3,1.2.840.10045.3.1.3], [X9.62 prime239v1,1.2.840.10045.3.1.4], [X9.62 prime239v2,1.2.840.10045.3.1.5], [X9.62 prime239v3,1.2.840.10045.3.1.6], [sect113r1,1.3.132.0.4], [sect113r2,1.3.132.0.5], [sect131r1,1.3.132.0.22], [sect131r2,1.3.132.0.23], [sect163k1,NIST K-163,1.3.132.0.1], [sect163r1,1.3.132.0.2], [sect163r2,NIST B-163,1.3.132.0.15], [sect193r1,1.3.132.0.24], [sect193r2,1.3.132.0.25], [sect233k1,NIST K-233,1.3.132.0.26], [sect233r1,NIST B-233,1.3.132.0.27], [sect239k1,1.3.132.0.3], [sect283k1,NIST K-283,1.3.132.0.16], [sect283r1,NIST B-283,1.3.132.0.17], [sect409k1,NIST K-409,1.3.132.0.36], [sect409r1,NIST B-409,1.3.132.0.37], [sect571k1,NIST K-571,1.3.132.0.38], [sect571r1,NIST B-571,1.3.132.0.39], [X9.62 c2tnb191v1,1.2.840.10045.3.0.5], [X9.62 c2tnb191v2,1.2.840.10045.3.0.6], [X9.62 c2tnb191v3,1.2.840.10045.3.0.7], [X9.62 c2tnb239v1,1.2.840.10045.3.0.11], [X9.62 c2tnb239v2,1.2.840.10045.3.0.12], [X9.62 c2tnb239v3,1.2.840.10045.3.0.13], [X9.62 c2tnb359v1,1.2.840.10045.3.0.18], [X9.62 c2tnb431r1,1.2.840.10045.3.0.20], [brainpoolP160r1,1.3.36.3.3.2.8.1.1.1], [brainpoolP192r1,1.3.36.3.3.2.8.1.1.3], [brainpoolP224r1,1.3.36.3.3.2.8.1.1.5], [brainpoolP256r1,1.3.36.3.3.2.8.1.1.7], [brainpoolP320r1,1.3.36.3.3.2.8.1.1.9], [brainpoolP384r1,1.3.36.3.3.2.8.1.1.11], [brainpoolP512r1,1.3.36.3.3.2.8.1.1.13]] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [abc@abc]$ java ECKeypair.java Sun EC public key, 256 bits public x coord: 63986856163979328932326932795073128365874657917388037499756780642199935477520 public y coord: 54650331961321053445469054135751865434074157785252964058669743652357688192033 parameters: secp256k1 (1.3.132.0.10) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Version-Release number of selected component (if applicable): RHEL 7.6 java-11-openjdk-11.0.1.13-3.el7_6.x86_64 How reproducible: It will be reproducible in RHEL 7.4/ 7.6 using java-11-openjdk-11.0.1.13-3.el7_6.x86_64 using the code snippet provided in Steps to Reproduce. Steps to Reproduce: 1. ~~~~~~~~~~~~~~~~~~~~ import java.security.Security; import java.util.*; public class Curves { public static void main(String[] args) throws Exception { String[] curves = Security.getProvider("SunEC").getProperty("AlgorithmParameters.EC SupportedCurves").split("\\|"); System.out.println(Arrays.toString(curves)); } } ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ import java.security.KeyPair; import java.security.spec.ECGenParameterSpec; import java.security.KeyPairGenerator; import java.security.PrivateKey; import java.security.PublicKey; import java.security.SecureRandom; public class ECkeypair { public static void main(String[] args) throws Exception { KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC"); ECGenParameterSpec ecs = new ECGenParameterSpec("secp256k1"); keyGen.initialize(ecs, new SecureRandom()); KeyPair pair = keyGen.genKeyPair(); PrivateKey priv = pair.getPrivate(); PublicKey pub = pair.getPublic(); System.out.println(pub.toString()); //System.out.println(priv.toString()); } } ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Actual results: 1. [abc@abc]$ java Curves.java [[secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]] 2. [abc@abc]$ java ECKeypair.java Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1 at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103) at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699) at ECkeypair.main(ECKeypair.java:13) Expected results: It should return secp256k1 Additional info: I used same openssl version for testing with both OpenJDK. ~~~~~~~~~~~~~~~~~~~~~~~~~~ [abc@abc]$ openssl OpenSSL> version OpenSSL 1.0.2k-fips 26 Jan 2017 ~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~ [abc@abc]$ openssl OpenSSL> ecparam -list_curves secp256k1 : SECG curve over a 256 bit prime field secp384r1 : NIST/SECG curve over a 384 bit prime field secp521r1 : NIST/SECG curve over a 521 bit prime field prime256v1: X9.62/SECG curve over a 256 bit prime field