Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8223482

Unsupported ciphersuites may be offered by a TLS client

    XMLWordPrintable

Details

    • 11
    • b23
    • generic
    • generic

    Backports

      Description

        A TLS client may offer ciphersuites that it does not support to a TLS server. This happens when SunJCE security provider is disabled. Once possible reason for disabling SunJCE is enabling FIPS mode.

        There is an explicit assumption that SunJCE will always be available, when deciding if a ciphersuite is enabled: http://hg.openjdk.java.net/jdk/jdk/file/4f2fd02922b1/src/java.base/share/classes/sun/security/ssl/SSLCipher.java#l492

        In the context of fixing this bug, we should review that assumption and check whether or not the ciphersuite should be offered in run time.

        To reproduce this bug, we can apply the attached patch to FipsModeTLS12 test. The TLS client will offer TLS_RSA_WITH_AES_128_GCM_SHA256 ciphersuite while AES/GCM/NoPadding transformation is not available in SunPKCS11 provider. Verified in JDK revision df2b3565f343.

        Attachments

          Issue Links

            backported by

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8225827 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8228595 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8239412 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8243699 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8247032 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8256915 Unsupported ciphersuites may be offered by a TLS client

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Closed
            relates to

            Bug - A problem which impairs or prevents the functions of the product. JDK-8224954 Test failures with NoSuchAlgorithmException: Unsupported mode GCM after JDK-8223482

            • P3 - Major loss of function.
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. JDK-8225739 sun/security/pkcs11/tls/tls12/FipsModeTLS12.java is not reliable

            • P3 - Major loss of function.
            • Open

            Bug - A problem which impairs or prevents the functions of the product. JDK-8222937 Cannot establish TLS connections in FIPS mode

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Open

            Activity

              People

                mbalao Martin Balao Alonso
                mbalao Martin Balao Alonso
                Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: