ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Colm O hEigeartaigh (JIRA)" <j...@apache.org>
Subject [jira] [Resolved] (WSS-536) WSSecurityUtil.getCipherInstance() does not use configured provider
Date Wed, 22 Apr 2015 12:16:59 GMT

     [ https://issues.apache.org/jira/browse/WSS-536?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Colm O hEigeartaigh resolved WSS-536.
-------------------------------------
    Resolution: Fixed

> WSSecurityUtil.getCipherInstance() does not use configured provider
> -------------------------------------------------------------------
>
>                 Key: WSS-536
>                 URL: https://issues.apache.org/jira/browse/WSS-536
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 1.6.17, 1.6.18, 2.0.3
>            Reporter: Kim Rasmussen
>            Assignee: Colm O hEigeartaigh
>            Priority: Critical
>             Fix For: 2.0.4, 1.6.19, 2.1.0
>
>
> org.apache.ws.security.util.WSSecurityUtil.getCipherInstance looks like below:
> {code}
>     public static Cipher getCipherInstance(String cipherAlgo)
>         throws WSSecurityException {
>         try {
>             String keyAlgorithm = JCEMapper.translateURItoJCEID(cipherAlgo);
>             return Cipher.getInstance(keyAlgorithm);
>         } catch (NoSuchPaddingException ex) {
>             throw new WSSecurityException(
>                 WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp", 
>                 new Object[] { "No such padding: " + cipherAlgo }, ex
>             );
>         } catch (NoSuchAlgorithmException ex) {
>             // Check to see if an RSA OAEP MGF-1 with SHA-1 algorithm was requested
>             // Some JDKs don't support RSA/ECB/OAEPPadding
>             if (WSConstants.KEYTRANSPORT_RSAOEP.equals(cipherAlgo)) {
>                 try {
>                     return Cipher.getInstance("RSA/ECB/OAEPWithSHA1AndMGF1Padding");
>                 } catch (Exception e) {
>                     throw new WSSecurityException(
>                         WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp",
>                         new Object[] { "No such algorithm: " + cipherAlgo }, e
>                     );
>                 }
>             } else {
>                 throw new WSSecurityException(
>                     WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp",
>                     new Object[] { "No such algorithm: " + cipherAlgo }, ex
>                 );
>             }
>         }
>     }
> {code}
> It uses JCEMapper to translate an URL to a JCE cipher name, but it does not use the JCE
provider ID available in JCEMapper.getProviderId() - this has the consequence that it will
always chose the default JCE provider.
> The code should have been similar to this:
> {code}
> if (JCEMapper.getProviderId() != null)
>   return Cipher.getInstance(keyAlgorithm, JCEMapper.getProviderId());
> else
>   return Cipher.getInstance(keyAlgorithm);
> {code}
> The code above is similar to the signature handling code in the xmldsig project, found
in org.apache.xml.security.algorithms.implementations.SignatureBaseRSA
> Our current behaviour, is that signature checks work with the Luna provider, but encrypted
WS-Security fails since the wrong JCE provider is used for the Cipher.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org


Mime
View raw message