Bug 1699068 - Elliptic Curve secp256k1 is missing in java-11-openjdk-11.0.1.13-3.el7_6.x86_64
Summary: Elliptic Curve secp256k1 is missing in java-11-openjdk-11.0.1.13-3.el7_6.x86_64
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: java-11-openjdk
Version: 7.6
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: rc
: ---
Assignee: Andrew John Hughes
QA Contact: OpenJDK QA
URL:
Whiteboard:
Depends On: 1656677
Blocks: 1725255
TreeView+ depends on / blocked
 
Reported: 2019-04-11 17:01 UTC by pbarate
Modified: 2020-04-22 16:08 UTC (History)
4 users (show)

Fixed In Version: java-11-openjdk-11.0.5.2-0.2.ea.el7
Doc Type: Enhancement
Doc Text:
.OpenJDK now also supports secp256k1 Previously, Open Java Development Kit (OpenJDK) could only use curves from the NSS library. Consequently, OpenJDK provided only the secp256r1, secp384r1, and secp521r1 curves for elliptic curve cryptography (ECC). With this update, OpenJDK uses the internal ECC implementation and also supports the secp256k1 curve.
Clone Of:
Environment:
Last Closed: 2020-03-31 19:57:27 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Icedtea Bugzilla 3751 0 None None None 2019-08-27 11:49:04 UTC
Red Hat Product Errata RHBA-2020:1088 0 None None None 2020-03-31 19:58:19 UTC

Description pbarate 2019-04-11 17:01:06 UTC
Description of problem:
  I have a customer who is using RHEL 7.6 and java-11-openjdk-11.0.1.13-3.el7_6.x86_64(which we ship through rpm).
  While trying to fetch elliptic curve secp256k1 using small java program it is giving the below error instead of returning elliptic curve secp256k1

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When I am trying to run the programs mentioned in "Steps to Reproduce" using community version of Open JDK 11.0.2 General-Availability Release.

I am getting below output and program works fine
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java Curves.java 
[[secp112r1,1.3.132.0.6], [secp112r2,1.3.132.0.7], [secp128r1,1.3.132.0.28], [secp128r2,1.3.132.0.29], [secp160k1,1.3.132.0.9], [secp160r1,1.3.132.0.8], [secp160r2,1.3.132.0.30], [secp192k1,1.3.132.0.31], [secp192r1,NIST P-192,X9.62 prime192v1,1.2.840.10045.3.1.1], [secp224k1,1.3.132.0.32], [secp224r1,NIST P-224,1.3.132.0.33], [secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35], [X9.62 prime192v2,1.2.840.10045.3.1.2], [X9.62 prime192v3,1.2.840.10045.3.1.3], [X9.62 prime239v1,1.2.840.10045.3.1.4], [X9.62 prime239v2,1.2.840.10045.3.1.5], [X9.62 prime239v3,1.2.840.10045.3.1.6], [sect113r1,1.3.132.0.4], [sect113r2,1.3.132.0.5], [sect131r1,1.3.132.0.22], [sect131r2,1.3.132.0.23], [sect163k1,NIST K-163,1.3.132.0.1], [sect163r1,1.3.132.0.2], [sect163r2,NIST B-163,1.3.132.0.15], [sect193r1,1.3.132.0.24], [sect193r2,1.3.132.0.25], [sect233k1,NIST K-233,1.3.132.0.26], [sect233r1,NIST B-233,1.3.132.0.27], [sect239k1,1.3.132.0.3], [sect283k1,NIST K-283,1.3.132.0.16], [sect283r1,NIST B-283,1.3.132.0.17], [sect409k1,NIST K-409,1.3.132.0.36], [sect409r1,NIST B-409,1.3.132.0.37], [sect571k1,NIST K-571,1.3.132.0.38], [sect571r1,NIST B-571,1.3.132.0.39], [X9.62 c2tnb191v1,1.2.840.10045.3.0.5], [X9.62 c2tnb191v2,1.2.840.10045.3.0.6], [X9.62 c2tnb191v3,1.2.840.10045.3.0.7], [X9.62 c2tnb239v1,1.2.840.10045.3.0.11], [X9.62 c2tnb239v2,1.2.840.10045.3.0.12], [X9.62 c2tnb239v3,1.2.840.10045.3.0.13], [X9.62 c2tnb359v1,1.2.840.10045.3.0.18], [X9.62 c2tnb431r1,1.2.840.10045.3.0.20], [brainpoolP160r1,1.3.36.3.3.2.8.1.1.1], [brainpoolP192r1,1.3.36.3.3.2.8.1.1.3], [brainpoolP224r1,1.3.36.3.3.2.8.1.1.5], [brainpoolP256r1,1.3.36.3.3.2.8.1.1.7], [brainpoolP320r1,1.3.36.3.3.2.8.1.1.9], [brainpoolP384r1,1.3.36.3.3.2.8.1.1.11], [brainpoolP512r1,1.3.36.3.3.2.8.1.1.13]]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Sun EC public key, 256 bits
  public x coord: 63986856163979328932326932795073128365874657917388037499756780642199935477520
  public y coord: 54650331961321053445469054135751865434074157785252964058669743652357688192033
  parameters: secp256k1 (1.3.132.0.10)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Version-Release number of selected component (if applicable):
  RHEL 7.6
  java-11-openjdk-11.0.1.13-3.el7_6.x86_64

How reproducible:
It will be reproducible in RHEL 7.4/ 7.6 using java-11-openjdk-11.0.1.13-3.el7_6.x86_64 using the code snippet provided in Steps to Reproduce.



Steps to Reproduce:
1.
~~~~~~~~~~~~~~~~~~~~ 
import java.security.Security;
import java.util.*;
public class Curves
{
  public static void main(String[] args)
    throws Exception
  {
    String[] curves = Security.getProvider("SunEC").getProperty("AlgorithmParameters.EC SupportedCurves").split("\\|");
    System.out.println(Arrays.toString(curves));
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
import java.security.KeyPair;
import java.security.spec.ECGenParameterSpec;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;

public class ECkeypair
{
  public static void main(String[] args)     throws Exception {
     KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
     ECGenParameterSpec ecs = new ECGenParameterSpec("secp256k1");
     keyGen.initialize(ecs, new SecureRandom());
     KeyPair pair = keyGen.genKeyPair();
     PrivateKey priv = pair.getPrivate();
     PublicKey pub = pair.getPublic();
     System.out.println(pub.toString());
     //System.out.println(priv.toString());
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Actual results:
1.
[abc@abc]$ java Curves.java 
[[secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]]

2.
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)

Expected results:
It should return secp256k1

Additional info:

I used same openssl version for testing with both OpenJDK.
~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> version
OpenSSL 1.0.2k-fips  26 Jan 2017
 ~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> ecparam -list_curves
  secp256k1 : SECG curve over a 256 bit prime field
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field

Comment 2 Andrew John Hughes 2019-05-24 03:23:23 UTC
Deferring to 7.8 as this will need time for a crypto & PELC review.

Comment 3 jiri vanek 2019-06-27 07:21:51 UTC
Tested by https://github.com/judovana/CryptoTest/
Manual check for given explicit curve will be necessary

Comment 4 Andrew John Hughes 2019-08-27 11:49:05 UTC
With the revised removal patch (IcedTea PR3751), which retains ssecp256k1:

$ /mnt/builder/shenandoah.11/images/jdk/bin/java Curves
[[secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]]

$ /mnt/builder/shenandoah.11/images/jdk/bin/java ECKeyPair
Sun EC public key, 256 bits
  public x coord: 79523231440252223545206576613674799022307975635301802899245219154254251779667
  public y coord: 73467828469929858295500430696061047515425097562480352925430311428120235169575
  parameters: secp256k1 (1.3.132.0.10)

Comment 6 Andrew John Hughes 2019-08-29 11:55:22 UTC
$ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java -version
openjdk version "11.0.5-ea" 2019-10-15 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.5-ea+2-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.5-ea+2-LTS, mixed mode)

$ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java Curves
[[secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]]

$ ./usr/lib/jvm/java-11-openjdk-11.0.5.2-0.2.ea.el7.x86_64/bin/java ECKeyPair
Sun EC public key, 256 bits
  public x coord: 38540685351311776496837147664686496462553578459953286438120003757034125588588
  public y coord: 749815700193903859740125736338725457550786883309687499594725670082022165421
  parameters: secp256k1 (1.3.132.0.10)

Comment 10 errata-xmlrpc 2020-03-31 19:57:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1088


Note You need to log in before you can comment on or make changes to this bug.