Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8368514

TLS stateless session ticket decryption fails on some providers

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: P4 P4
    • 26
    • 13, 26
    • security-libs
    • None

      Observed when testing SunPKCS11, but may also affect other providers.

      Session ticket decryption assumes that the cipher in use will work with the minimal output buffer size. However, due to a limitation of older NSS versions, SunPKCS11 AES cipher requires a larger buffer size for decryption [1], and the decryption fails with a ShortBufferException.

      [1] https://github.com/openjdk/jdk/blob/303686684c23db465ccfb6a9b4861a673bfa5f4b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11AEADCipher.java#L500-L503

            djelinski Daniel Jelinski
            djelinski Daniel Jelinski
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: