1746875 – Elliptic Curve secp256k1 is missing in java-11-openjdk

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1746875 - Elliptic Curve secp256k1 is missing in java-11-openjdk

Summary: Elliptic Curve secp256k1 is missing in java-11-openjdk

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	java-11-openjdk
Sub Component:
Version:	8.1
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	8.2
Assignee:	Andrew John Hughes
QA Contact:	OpenJDK QA
Docs Contact:	Lenka Špačková
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2019-08-29 12:18 UTC by Andrew John Hughes
Modified:	2020-12-20 09:22 UTC (History)
CC List:	3 users (show)
Fixed In Version:	java-11-openjdk-11.0.5.10-6.el8
Doc Type:	Enhancement
Doc Text:	.OpenJDK now supports also secp256k1 Previously, Open Java Development Kit (OpenJDK) could use only curves from the NSS library. Consequently, OpenJDK provided only the secp256r1, secp384r1, and secp521r1 curves for elliptic curve cryptography (ECC). With this update, OpenJDK uses the internal ECC implementation and supports also the secp256k1 curve.
Clone Of:
Environment:
Last Closed:	2020-04-28 15:46:29 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2020:1647	0	None	None	None	2020-04-28 15:47:01 UTC

Description Andrew John Hughes 2019-08-29 12:18:27 UTC

This bug was initially created as a copy of Bug #1746874

I am copying this bug because: 

We are introducing the curve on RHEL 7, so should do the same on RHEL 8.

This bug was initially created as a copy of Bug #1699068

I am copying this bug because: 

We should keep the number of supported curves in sync between different OpenJDK versions.

Description of problem:
  I have a customer who is using RHEL 7.6 and java-11-openjdk-11.0.1.13-3.el7_6.x86_64(which we ship through rpm).
  While trying to fetch elliptic curve secp256k1 using small java program it is giving the below error instead of returning elliptic curve secp256k1

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When I am trying to run the programs mentioned in "Steps to Reproduce" using community version of Open JDK 11.0.2 General-Availability Release.

I am getting below output and program works fine
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java Curves.java 
[[secp112r1,1.3.132.0.6], [secp112r2,1.3.132.0.7], [secp128r1,1.3.132.0.28], [secp128r2,1.3.132.0.29], [secp160k1,1.3.132.0.9], [secp160r1,1.3.132.0.8], [secp160r2,1.3.132.0.30], [secp192k1,1.3.132.0.31], [secp192r1,NIST P-192,X9.62 prime192v1,1.2.840.10045.3.1.1], [secp224k1,1.3.132.0.32], [secp224r1,NIST P-224,1.3.132.0.33], [secp256k1,1.3.132.0.10], [secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35], [X9.62 prime192v2,1.2.840.10045.3.1.2], [X9.62 prime192v3,1.2.840.10045.3.1.3], [X9.62 prime239v1,1.2.840.10045.3.1.4], [X9.62 prime239v2,1.2.840.10045.3.1.5], [X9.62 prime239v3,1.2.840.10045.3.1.6], [sect113r1,1.3.132.0.4], [sect113r2,1.3.132.0.5], [sect131r1,1.3.132.0.22], [sect131r2,1.3.132.0.23], [sect163k1,NIST K-163,1.3.132.0.1], [sect163r1,1.3.132.0.2], [sect163r2,NIST B-163,1.3.132.0.15], [sect193r1,1.3.132.0.24], [sect193r2,1.3.132.0.25], [sect233k1,NIST K-233,1.3.132.0.26], [sect233r1,NIST B-233,1.3.132.0.27], [sect239k1,1.3.132.0.3], [sect283k1,NIST K-283,1.3.132.0.16], [sect283r1,NIST B-283,1.3.132.0.17], [sect409k1,NIST K-409,1.3.132.0.36], [sect409r1,NIST B-409,1.3.132.0.37], [sect571k1,NIST K-571,1.3.132.0.38], [sect571r1,NIST B-571,1.3.132.0.39], [X9.62 c2tnb191v1,1.2.840.10045.3.0.5], [X9.62 c2tnb191v2,1.2.840.10045.3.0.6], [X9.62 c2tnb191v3,1.2.840.10045.3.0.7], [X9.62 c2tnb239v1,1.2.840.10045.3.0.11], [X9.62 c2tnb239v2,1.2.840.10045.3.0.12], [X9.62 c2tnb239v3,1.2.840.10045.3.0.13], [X9.62 c2tnb359v1,1.2.840.10045.3.0.18], [X9.62 c2tnb431r1,1.2.840.10045.3.0.20], [brainpoolP160r1,1.3.36.3.3.2.8.1.1.1], [brainpoolP192r1,1.3.36.3.3.2.8.1.1.3], [brainpoolP224r1,1.3.36.3.3.2.8.1.1.5], [brainpoolP256r1,1.3.36.3.3.2.8.1.1.7], [brainpoolP320r1,1.3.36.3.3.2.8.1.1.9], [brainpoolP384r1,1.3.36.3.3.2.8.1.1.11], [brainpoolP512r1,1.3.36.3.3.2.8.1.1.13]]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ java ECKeypair.java 
Sun EC public key, 256 bits
  public x coord: 63986856163979328932326932795073128365874657917388037499756780642199935477520
  public y coord: 54650331961321053445469054135751865434074157785252964058669743652357688192033
  parameters: secp256k1 (1.3.132.0.10)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Version-Release number of selected component (if applicable):
  RHEL 7.6
  java-11-openjdk-11.0.1.13-3.el7_6.x86_64

How reproducible:
It will be reproducible in RHEL 7.4/ 7.6 using java-11-openjdk-11.0.1.13-3.el7_6.x86_64 using the code snippet provided in Steps to Reproduce.



Steps to Reproduce:
1.
~~~~~~~~~~~~~~~~~~~~ 
import java.security.Security;
import java.util.*;
public class Curves
{
  public static void main(String[] args)
    throws Exception
  {
    String[] curves = Security.getProvider("SunEC").getProperty("AlgorithmParameters.EC SupportedCurves").split("\\|");
    System.out.println(Arrays.toString(curves));
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
import java.security.KeyPair;
import java.security.spec.ECGenParameterSpec;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;

public class ECkeypair
{
  public static void main(String[] args)     throws Exception {
     KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
     ECGenParameterSpec ecs = new ECGenParameterSpec("secp256k1");
     keyGen.initialize(ecs, new SecureRandom());
     KeyPair pair = keyGen.genKeyPair();
     PrivateKey priv = pair.getPrivate();
     PublicKey pub = pair.getPublic();
     System.out.println(pub.toString());
     //System.out.println(priv.toString());
  }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Actual results:
1.
[abc@abc]$ java Curves.java 
[[secp256r1,NIST P-256,X9.62 prime256v1,1.2.840.10045.3.1.7], [secp384r1,NIST P-384,1.3.132.0.34], [secp521r1,NIST P-521,1.3.132.0.35]]

2.
[abc@abc]$ java ECKeypair.java 
Exception in thread "main" java.security.InvalidAlgorithmParameterException: Unknown curve name: secp256k1
	at jdk.crypto.ec/sun.security.ec.ECKeyPairGenerator.initialize(ECKeyPairGenerator.java:103)
	at java.base/java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:699)
	at ECkeypair.main(ECKeypair.java:13)

Expected results:
It should return secp256k1

Additional info:

I used same openssl version for testing with both OpenJDK.
~~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> version
OpenSSL 1.0.2k-fips  26 Jan 2017
 ~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~
[abc@abc]$ openssl
OpenSSL> ecparam -list_curves
  secp256k1 : SECG curve over a 256 bit prime field
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field

Comment 7 errata-xmlrpc 2020-04-28 15:46:29 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1647

Note You need to log in before you can comment on or make changes to this bug.