PH17464: High CPU when using Elliptic Curve Ciphers (ECC) and the IBMJCECCA and IBMJSSE2 Providers.

APAR status

• Closed as program error.

Error description

• Error Message:
  High CPU can be experienced with Java on z/OS and zLinux when
  using the IBMJCECCA and IBMJSSE2 Providers, and using
  ECGenParameterSpec with an OID.
  
  To confirm please set the following java options:
   -Djavax.net.debug=true -Djava.security.auth.debug=all
  which will write trace to strerr.
  
  Many  java.security.spec.InvalidParameterSpecException
  Exceptions, similar to the following, will be seen in the trace.
  Note that there are a number of different code paths which could
  and will lead to this Exception, the following is an example of
  one of these.
  
  .
  Stack Trace: java.security.spec.InvalidParameterSpecException:
  The specified parameter specification is not supported
  com.ibm.crypto.hdwrCCA.provider.ECKeyPairGenerator.initialize(EC
  KeyPairGenerator.java:18)
                 at
  java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenera
  tor.java:685)
                 at com.ibm.jsse2.Q.n(Q.java:122)
                 at com.ibm.jsse2.F.A(F.java:563)
                 at com.ibm.jsse2.F.a(F.java:160)
                 at com.ibm.jsse2.F.b(F.java:598)
                 at com.ibm.jsse2.F.a(F.java:293)
                 at com.ibm.jsse2.F.a(F.java:922)
                 at com.ibm.jsse2.D.r(D.java:444)
                 at com.ibm.jsse2.D$b.a(D$b.java:2)
                 at com.ibm.jsse2.D$b.run(D$b.java:3)
  .
  

Local fix

• N/A
  

Problem summary

• IBMJCECCA does not tolerate OIDs for EC KeyPair Generation while
  using an ECGenParameterSpec.
  

Problem conclusion

• IBMJCECCA is being changed such that the ECGenParameterSpec can
  tolerate OIDs in addition to standard names for EC curves.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR6       (8.0.6.0)
     7    SR10 FP55 (7.0.10.55)
     7 R1 SR4 FP55  (7.1.4.55)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels