IJ15047: IBM JCE / JCEPLUS PROVIDERS NOT CORRECTLY RESETTING ECDSA STATES

APAR status

• Closed as program error.

Error description

• Error Message: According to the Java 8 Javadoc, instances of
  java.security.Signature should reset after a verify or sign
  operation to the state immediately after the last initVerify or
  initSign. For the IBM JCE & JCEPlus providers resetting of the
  states do not happen after ECSDA sign and verify operations.
  The verify operation returns false when a signature, generated
  using ECDSA algorithm is verified.
  .
  Stack Trace: N/A
  .
  

Local fix

• Initialize the ECDSA Signature object before every sign or
  verify operations.
  

Problem summary

• IBM JCE / JCEPlus providers not correctly resetting ECDSA
  states, resulting in signature verify operation to fail.
  

Problem conclusion

• The IBMJCE,  IBMJCEPlus, IBMJCEPlusFIPS providers for IBM SDK 8
  have been updated to conform to the Javadocs specifications.
  The GIT issue associated with this change is 24.
  The RTC Problem report associated with this change is 139912
  The affected IBM JVM's are:  8.0
  The affected jar file is ibmjceprovider.jar and ibmjceplus.jar
  The build level of the updated ibmjceprovider.jar is 20190321.
  The build level of the update ibmjceplus.jar is 20190325.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR5 FP35  (8.0.5.35)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels