Mailing-List: contact dev-help@ws.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ws.apache.org
Date: Wed, 22 Apr 2015 17:15:59 +0000 (UTC)
From: "Kim Rasmussen (JIRA)" <jira@apache.org>
To: dev@ws.apache.org
Message-ID: <JIRA.12822726.1429635453000.77466.1429722959949@Atlassian.JIRA>
In-Reply-To: <JIRA.12822726.1429635453000@Atlassian.JIRA>
References: <JIRA.12822726.1429635453000@Atlassian.JIRA>
 <JIRA.12822726.1429635453017@arcas>
Subject: [jira] [Commented] (WSS-536) WSSecurityUtil.getCipherInstance()
 does not use configured provider
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/WSS-536?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14507448#comment-14507448 ] 

Kim Rasmussen commented on WSS-536:
-----------------------------------

Awesome, thanks for the quick fix.

Any idea when 1.6.19 will be released ? Can I find that info somewhere ?

> WSSecurityUtil.getCipherInstance() does not use configured provider
> -------------------------------------------------------------------
>
>                 Key: WSS-536
>                 URL: https://issues.apache.org/jira/browse/WSS-536
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 1.6.17, 1.6.18, 2.0.3
>            Reporter: Kim Rasmussen
>            Assignee: Colm O hEigeartaigh
>            Priority: Critical
>             Fix For: 2.0.4, 1.6.19, 2.1.0
>
>
> org.apache.ws.security.util.WSSecurityUtil.getCipherInstance looks like below:
> {code}
>     public static Cipher getCipherInstance(String cipherAlgo)
>         throws WSSecurityException {
>         try {
>             String keyAlgorithm = JCEMapper.translateURItoJCEID(cipherAlgo);
>             return Cipher.getInstance(keyAlgorithm);
>         } catch (NoSuchPaddingException ex) {
>             throw new WSSecurityException(
>                 WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp", 
>                 new Object[] { "No such padding: " + cipherAlgo }, ex
>             );
>         } catch (NoSuchAlgorithmException ex) {
>             // Check to see if an RSA OAEP MGF-1 with SHA-1 algorithm was requested
>             // Some JDKs don't support RSA/ECB/OAEPPadding
>             if (WSConstants.KEYTRANSPORT_RSAOEP.equals(cipherAlgo)) {
>                 try {
>                     return Cipher.getInstance("RSA/ECB/OAEPWithSHA1AndMGF1Padding");
>                 } catch (Exception e) {
>                     throw new WSSecurityException(
>                         WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp",
>                         new Object[] { "No such algorithm: " + cipherAlgo }, e
>                     );
>                 }
>             } else {
>                 throw new WSSecurityException(
>                     WSSecurityException.UNSUPPORTED_ALGORITHM, "unsupportedKeyTransp",
>                     new Object[] { "No such algorithm: " + cipherAlgo }, ex
>                 );
>             }
>         }
>     }
> {code}
> It uses JCEMapper to translate an URL to a JCE cipher name, but it does not use the JCE provider ID available in JCEMapper.getProviderId() - this has the consequence that it will always chose the default JCE provider.
> The code should have been similar to this:
> {code}
> if (JCEMapper.getProviderId() != null)
>   return Cipher.getInstance(keyAlgorithm, JCEMapper.getProviderId());
> else
>   return Cipher.getInstance(keyAlgorithm);
> {code}
> The code above is similar to the signature handling code in the xmldsig project, found in org.apache.xml.security.algorithms.implementations.SignatureBaseRSA
> Our current behaviour, is that signature checks work with the Luna provider, but encrypted WS-Security fails since the wrong JCE provider is used for the Cipher.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org