IJ34653: IBMJSSE2 ENCOUNTERS KEYSIZE EXCEPTION WITH IBMJCEHYBRID AND IBMJCE ENABLED IN JAVA 8 ON Z/OS SR6 FP35

APAR status

• Closed as program error.

Error description

• An IBMJCEHybridException is thrown.
  
  The problem is caused when using IBMJCEHybrid and IBMJCE with
  IBMJSSE2 and large DiffieHellman keys.
  .
  Stack Trace:
  Caused by: IBMJCEHybridException: Failover exhausted, all
  registered providers attempted and failed.
  
  Exception#0 java.security.InvalidParameterException: Keysize
  must be multiple of 64, and can only range from 256 to 2048
  (inclusive)
  Stack Trace:
  at com.ibm.crypto.provider.DHKeyPairGenerator.initialize(Unknown
  Source)
  at
  java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenera
  tor.java:651)
  at
  com.ibm.crypto.ibmjcehybrid.provider.HybridKeyPairGenerator._ini
  tialize(HybridKeyPairGenerator.java:436)
  at
  com.ibm.crypto.ibmjcehybrid.provider.HybridKeyPairGenerator._ini
  tialize(HybridKeyPairGenerator.java:483)
  at
  com.ibm.crypto.ibmjcehybrid.provider.HybridKeyPairGenerator.init
  ialize(HybridKeyPairGenerator.java:384)
  

Local fix

• Please use an earlier SDK for Java maintenance level, such as
  8.0.6.31 (8.0 SR6 FP31)
  

Problem summary

• An IBMJCEHybridException, thrown by the IBMJCEHybrid security
  provider, is erroneously not caught by the IBMJSSE2 security
  framework.
  

Problem conclusion

• The IBMJSSE2 security framework now correctly catches and
  handles the IBMJCEHybridException.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR6 FP36  (8.0.6.36)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

• Include the com.ibm.crypto.plus.provider.IBMJCEPlus security
  provider in the provider list that is in the "java.security"
  file, or the file that overrides the "java.security" file, and
  place this provider ahead of the IBMJCE provider. If necessary
  please contact your Product support team for details of how to
  make this change.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels