Bug 2104725

Summary:	Avoid import/export of DH private keys [rhel-9, openjdk-17]
Product:	Red Hat Enterprise Linux 9	Reporter:	Francisco Ferrari Bihurriet <fferrari>
Component:	java-17-openjdk	Assignee:	Francisco Ferrari Bihurriet <fferrari>
Status:	CLOSED ERRATA	QA Contact:	OpenJDK QA <java-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.1	CC:	ahughes, jandrlik, pmikova
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	fferrari: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	java-17-openjdk-17.0.4.1.1-3.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2123580 (view as bug list)		Environment:
Last Closed:	2022-11-15 10:01:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2123580

Description Francisco Ferrari Bihurriet 2022-07-07 03:25:38 UTC

This bug was initially created as a copy of Bug #2104724

I am copying this bug because: 
We need to fix this for RHEL 9 too.

As analyzed in OPENJDK-824 [1], NSS doesn't support wrapping/unwrapping of Diffie-Hellman private keys (CKK_DH), so we can't import/export them from the NSS PKCS#11 software token.

In addition, as part of Bug 2029657 work, we started to blindly consider a private key extractable when the plain key support is enabled [2], preventing DH private keys from being instantiated as the opaque P11PrivateKey. This now causes an error, as an attempt is made to extract these keys when instantiating the P11DHPrivateKey full-data object.

This work:
 1. Avoids the import/export of DH private keys, going back to the opaque P11PrivateKey for them (instead of P11DHPrivateKey)
 2. Removes the useless code from the FIPS key importer (Bug 1994661), which hasn't triggered any issue, but it will never work
   • NOTE: the FIPS key exporter doesn't have code to handle CKK_DH private keys.

[1] https://issues.redhat.com/browse/OPENJDK-824?focusedCommentId=20495041&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-20495041
[2] https://github.com/rh-openjdk/jdk/commit/bd324bda437a924e58730cc67c133275e8203780#diff-8f7a3a78c41a81cc7d6198037c7cdaf5fc42d3536921d3751d8bbb681265dbe8R387-R388

Comment 12 errata-xmlrpc 2022-11-15 10:01:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (java-17-openjdk bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:6709