Bug 1746874

Summary: Elliptic Curve secp256k1 is missing in java-1.8.0-openjdk
Product: Red Hat Enterprise Linux 7 Reporter: Andrew John Hughes <ahughes>
Component: java-1.8.0-openjdkAssignee: Andrew John Hughes <ahughes>
Status: CLOSED ERRATA QA Contact: OpenJDK QA <java-qa>
Severity: unspecified Docs Contact: sagar <sdubewar>
Priority: unspecified    
Version: 7.6CC: dbhole, hkario, jvanek, lkuprova, lmiksik, mjahoda, sdubewar, zzambers
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: java-1.8.0-openjdk-1.8.0.232.b09-4.el7 Doc Type: Enhancement
Doc Text:
.OpenJDK now supports also secp256k1 Previously, Open Java Development Kit (OpenJDK) could use only curves from the NSS library. Consequently, OpenJDK provided only the secp256r1, secp384r1, and secp521r1 curves for elliptic curve cryptography (ECC). With this update, OpenJDK uses the internal ECC implementation and supports also the secp256k1 curve.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-31 19:51:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1725255    

Description Andrew John Hughes 2019-08-29 12:14:42 UTC
This bug was initially created as a copy of Bug #1699068

I am copying this bug because: 

We should keep the number of supported curves in sync between different OpenJDK versions.

Description of problem:
  I have a customer who is using RHEL 7.6 and java-11-openjdk-11.0.1.13-3.el7_6.x86_64(which we ship through rpm).
  While trying to fetch elliptic curve secp256k1 using small java program it is giving the below error instead of returning elliptic curve secp256k1

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When I am trying to run the programs mentioned in "Steps to Reproduce" using community version of Open JDK 11.0.2 General-Availability Release.

I am getting below output and program works fine
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java Curves.java 
[[secp112r1,1.3.132.0.6], [secp112r2,1.3.132.0.7], [secp128r1,1.3.132.0.28], [secp128r2,1.3.132.0.29], [secp160k1,1.3.132.0.9], [secp160r1,1.3.132.0.8], [secp160r2,1.3.132.0.30], [secp192k1,1.3.132.0.31], [secp192r1,NIST P-192,X9.62 prime192v1,1.2.840.10045.3.1.1], [secp224k1,1.3.132.0.32], [secp224r1,NIST P-224,1.3.132.0.33], [secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35], [X9.62 prime192v2,1.2.840.10045.3.1.2], [X9.62 prime192v3,1.2.840.10045.3.1.3], [X9.62 prime239v1,1.2.840.10045.3.1.4], [X9.62 prime239v2,1.2.840.10045.3.1.5], [X9.62 prime239v3,1.2.840.10045.3.1.6], [sect113r1,1.3.132.0.4], [sect113r2,1.3.132.0.5], [sect131r1,1.3.132.0.22], [sect131r2,1.3.132.0.23], [sect163k1,NIST K-163,1.3.132.0.1], [sect163r1,1.3.132.0.2], [sect163r2,NIST B-163,1.3.132.0.15], [sect193r1,1.3.132.0.24], [sect193r2,1.3.132.0.25], [sect233k1,NIST K-233,1.3.132.0.26], [sect233r1,NIST B-233,1.3.132.0.27], [sect239k1,1.3.132.0.3], [sect283k1,NIST K-283,1.3.132.0.16], [sect283r1,NIST B-283,1.3.132.0.17], [sect409k1,NIST K-409,1.3.132.0.36], [sect409r1,NIST B-409,1.3.132.0.37], [sect571k1,NIST K-571,1.3.132.0.38], [sect571r1,NIST B-571,1.3.132.0.39], [X9.62 c2tnb191v1,1.2.840.10045.3.0.5], [X9.62 c2tnb191v2,1.2.840.10045.3.0.6], [X9.62 c2tnb191v3,1.2.840.10045.3.0.7], [X9.62 c2tnb239v1,1.2.840.10045.3.0.11], [X9.62 c2tnb239v2,1.2.840.10045.3.0.12], [X9.62 c2tnb239v3,1.2.840.10045.3.0.13], [X9.62 c2tnb359v1,1.2.840.10045.3.0.18], [X9.62 c2tnb431r1,1.2.840.10045.3.0.20], [brainpoolP160r1,1.3.36.3.3.2.8.1.1.1], [brainpoolP192r1,1.3.36.3.3.2.8.1.1.3], [brainpoolP224r1,1.3.36.3.3.2.8.1.1.5], [brainpoolP256r1,1.3.36.3.3.2.8.1.1.7], [brainpoolP320r1,1.3.36.3.3.2.8.1.1.9], [brainpoolP384r1,1.3.36.3.3.2.8.1.1.11], [brainpoolP512r1,1.3.36.3.3.2.8.1.1.13]]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Sun EC public key, 256 bits
  public x coord: 63986856163979328932326932795073128365874657917388037499756780642199935477520
  public y coord: 54650331961321053445469054135751865434074157785252964058669743652357688192033
  parameters: secp256k1 (1.3.132.0.10)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Version-Release number of selected component (if applicable):
  RHEL 7.6
  java-11-openjdk-11.0.1.13-3.el7_6.x86_64

How reproducible:
It will be reproducible in RHEL 7.4/ 7.6 using java-11-openjdk-11.0.1.13-3.el7_6.x86_64 using the code snippet provided in Steps to Reproduce.



Steps to Reproduce:
1.
~~~~~~~~~~~~~~~~~~~~ 
import java.security.Security;
import java.util.*;
public class Curves
{
  public static void main(String[] args)
    throws Exception
  {
    String[] curves = Security.getProvider("SunEC").getProperty("AlgorithmParameters.EC SupportedCurves").split("\\|");
    System.out.println(Arrays.toString(curves));
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
import java.security.KeyPair;
import java.security.spec.ECGenParameterSpec;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;

public class ECkeypair
{
  public static void main(String[] args)     throws Exception {
     KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
     ECGenParameterSpec ecs = new ECGenParameterSpec("secp256k1");
     keyGen.initialize(ecs, new SecureRandom());
     KeyPair pair = keyGen.genKeyPair();
     PrivateKey priv = pair.getPrivate();
     PublicKey pub = pair.getPublic();
     System.out.println(pub.toString());
     //System.out.println(priv.toString());
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Actual results:
1.
[abc@abc]$ java Curves.java 
[[secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]]

2.
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)

Expected results:
It should return secp256k1

Additional info:

I used same openssl version for testing with both OpenJDK.
~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> version
OpenSSL 1.0.2k-fips  26 Jan 2017
 ~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> ecparam -list_curves
  secp256k1 : SECG curve over a 256 bit prime field
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field

Comment 17 errata-xmlrpc 2020-03-31 19:51:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1071