Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8243551

Hmac Keys loaded from PKCS12 don't have a Standard Algorithm Name

XMLWordPrintable

      ADDITIONAL SYSTEM INFORMATION :
      Tested with OpenJDK 14.0.1 as provided from Oracle and also openJDK 11 and 1.8.0 from the Fedora Repositories

      A DESCRIPTION OF THE PROBLEM :
      When a Hmac key is loaded from a PKCS12 keystore, its Algorithm Name (Key#getAlgorithm) doesn't conform to Standard Algorithm Names as described in https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Create a HmacSha512 Key, store to pkcs12 keystore, load from keystore.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      The key loaded from the keystore should have standard algorithm name, as descibed in https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getAlgorithm--
      ACTUAL -
      The key loaded from the keystore has the algorithm name '1.2.840.113549.2.11' - which is not listed in https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html

      ---------- BEGIN SOURCE ----------
      import javax.crypto.spec.SecretKeySpec;
      import java.security.Key;
      import java.security.KeyStore;
      import java.security.cert.Certificate;

      public class Main {
      public static void main(String[] args) throws Exception {
      KeyStore pkcs12 = KeyStore.getInstance("pkcs12");
      pkcs12.load(null, "keystorepassword".toCharArray());

      Key generatedKey = new SecretKeySpec(new byte[512], "HmacSha512");
      System.out.println(generatedKey.getAlgorithm());
      pkcs12.setKeyEntry("testkey", generatedKey, "keypassword".toCharArray(), new Certificate[0]);
      Key keyFromKeystore = pkcs12.getKey("testkey", "keypassword".toCharArray());
      System.out.println(keyFromKeystore.getAlgorithm());

      assert generatedKey.getAlgorithm().equalsIgnoreCase(keyFromKeystore.getAlgorithm());
      }
      }
      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      After loading the key, one could probably "recreate" it as

      new SecretKeySpec(keyFromKeystore.getEncoded, "HmacSha512");

      FREQUENCY : always


            valeriep Valerie Peng
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: