Update the OpenJDK exclude tests list for FIPS #611
Comments
Exclude tests list from sanity.openjdkjava.security.NoSuchProviderException: no such provider: SunRsaSign
Existing Jars sign related
-keystore ks -storepass changeit -keypass changeit -keyalg rsa -alias a -dname CN=A -genkeypair
|
Exclude tests list from extended.openjdkjava.security.KeyStoreException: JCEKS not found
java.security.KeyStoreException: JKS not found
no such algorithm: DSA for provider SUN
Hard code provider SunJCE
no such provider: SunJCE
no such provider: SunRsaSign
java.lang.RuntimeException: Provider SunRsaSign not found.
Hard code provider SunRsaSign
SunJGSS provider & krb5 related
XMLDSig related
failed to load PKCS12 keystore related
Caused by: java.security.NoSuchAlgorithmException: PBES2 AlgorithmParameters not available
FIPS doesnt support DES secret key
check if a provider exactly equals to Sun
no such algorithm: MD2 for provider SUN
no such algorithm: MD5 for provider SUN
no such algorithm: NONEwithDSA for provider SUN
no such algorithm: PKCS11 for provider SUN
no such algorithm: SHA for provider SUN
no such algorithm: SHA-256 for provider SUN
NativePRNG SecureRandom not available
SHA1PRNG SecureRandom not available
SHA-512/224 MessageDigest not available
SHA-512/256 MessageDigest not available
DSS Signature not available
SunPKCS11-Solaris provider related
unrecognized algorithm name: PBKDF2WITHHMACSHA1
unrecognized algorithm name: PBEWITHMD5ANDDES
RSASSA-PSS AlgorithmParameters not available
failed to save PKCS12 keystore related. PBEWithSHA1AndRC2_40 AlgorithmParameters not available
load PBE SecretKeyFactory not available
RSASSA-PSS KeyPairGenerator not available
failed to translate a DSA public key from P11DSAKeyFactory
failed to translate a DSA private key from P11DSAKeyFactory
Failed to translate a DSA private key get from KeyPairGenerator
Could not create RSA private key due to the CKA_CLASS is CKO_PRIVATE_KEY
sun.security.pkcs11.P11Key$P11PrivateKey incompatible with sun.security.provider.DSAPrivateKey
Cant create a PKCS12 keystore related
Cannot find any provider supporting AESWrap
DES/DESede SecretKey algorithms is not supported
PBEWithSHA1AndRC2_40 AlgorithmParameters not available
PBEWithMD5AndDES SecretKeyFactory not available
PBEWithHmacSHA1AndAES_128 SecretKeyFactory not available
PBKDF2WithHmacSHA1/PBKDF2WithHmacSHA224/PBKDF2WithHmacSHA256/PBKDF2WithHmacSHA384/PBKDF2WithHmacSHA512 SecretKeyFactory not available
pbeWithMD5ANDdes SecretKeyFactory not available
PBEWithSHA1AndDESede AlgorithmParameters not available
FIPS does not support DES/ECB/PKCS5Padding
Cannot find any provider supporting PBEWithMD5AndTripleDES
Cannot find any provider supporting Blowfish
unrecognized algorithm name: PBEWithMD5AndDES
P11KeyPairGenerator doesnt support DesEDE
Could not create DH private key
sun.security.pkcs11.P11Key$P11DSAPublicKey incompatible with sun.security.x509.X509Key
XMLSignature provider is disabled in FIPS mode
Module java.security.sasl related.
java.security.ProviderException: Could not derive key
java.security.spec.InvalidKeySpecException: Could not create EC private key
java.security.KeyStoreException: Key protection algorithm not found: java.lang.NullPointerException
java.security.spec.InvalidKeySpecException: Could not create DH private key
Caused by: java.security.ProviderException: Initialization failed
java.lang.IllegalArgumentException: if keyStoreType is PKCS11, then keyStore must be NONE
javax.security.auth.login.LoginException: if keyStoreType is PKCS11 then keyStoreURL must be NONE
Could not generate keyPair for DH
All the below hard coded static String keyStoreFile = "keystore", and set the system property;
NSS module initial failures.
FIPS doesnt support ECB mode in AES/ECB/PKCS5Padding cipher
com.sun.exp.provider.EXP related
FIPS doesnt support DES secret key
Failed to create a PKCS12 keystore
FIPS doesnt support DESede algorithms
Cipher suites mismatch
FIPS doesnt support DKS keystore
Policy file related. Failed due to related to the keystore files.
Hard code checking if the provider is "MyProvider()"
keytool error: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_VALUE_INVALID
Cant create a keystore in FIPS by
We can generate different such as SslMacMD5/SslMacSHA1/HmacMD5/HmacSHA1/HmacSHA224/HmacSHA256/HmacSHA384/HmacSHA512 secret keys
Could not import DSA private key when invoke kpg.initialize(1024) after
We can generate DES secret keys but cant import it
testMDChange failed at:MD2/2500
Exception in thread "main" java.security.ProviderException: Unknown mechanism: 20
Can generate a TlsMasterSecret key via (TlsMasterSecret)kg.generateKey()
When FIPS mode is disabled, cacerts in ${JAVA_HOME}/jre/lib/security/cacerts is not empty.
|
|
detail explanation for #612 |
|
I am getting same |
|
The traceStack for In NSS docs version 3.15, it is mentioned that for Cipher mode AES-GCM. |
|
The traceStack for If we assign a directory to One solution that fix this issue is expanding -Djava.ext.dirs with {JAVA_HOME}/jre/lib/ext. A passed version can be seen from this <<grinder>> |
|
The exception is :
|
The FIPS mode has restrictive security configurations, so update the OpenJDK exclude tests list “ProblemList-fips.txt” for the FIPS testing.
The text was updated successfully, but these errors were encountered: