IV69232: AES-GCM IN IBMPKCS11IMPL IS CHOSEN EVEN THOUGH IT'S NOT ENABLED IN IBMPKCS11IMPL

APAR status

• Closed as program error.

Error description

• Error Message, as reported by customer:
  When specifying AES/GCM/NoPadding in Cipher.getInstance() when
  IBMPKCS11Impl provider is before IBMJCE provider in the
  provider list,  an  java.lang.UnsatisfiedLinkError exception
  was thrown.
  
  Stack Trace, if applicable:
  Exception in thread "main" java.lang.UnsatisfiedLinkError:
  com/ibm/pkcs11/nat/NativePKCS11Session.encryptDoFinalGCM(ILjava/
  lang/Object;Lcom/ibm/pkcs11/PKCS11Object;[BII[BI)I
      at
  com.ibm.crypto.pkcs11impl.provider.Session.encryptDoFinalGCM(Ses
  sion.java:774)
      at
  com.ibm.crypto.pkcs11impl.provider.PKCS11Cipher.engineDoFinalGCM
  (PKCS11Cipher.java:839)
      at
  com.ibm.crypto.pkcs11impl.provider.GeneralPKCS11Cipher.engineDoF
  inal(GeneralPKCS11Cipher.java:1046)
      at
  com.ibm.crypto.pkcs11impl.provider.GeneralPKCS11Cipher.engineDoF
  inal(GeneralPKCS11Cipher.java:890)
      at javax.crypto.Cipher.doFinal(Unknown Source)
      at com.ibm.jsse2.m.a(m.java:321)
      at com.ibm.jsse2.n$a.a(n$a.java:6)
      at com.ibm.jsse2.n$a.a(n$a.java:45)
      at com.ibm.jsse2.n.a(n.java:165)
      at com.ibm.jsse2.o.a(o.java:31)
      at com.ibm.jsse2.o.h(o.java:85)
      at com.ibm.jsse2.as.a(as.java:407)
      at com.ibm.jsse2.as.<init>(as.java:731)
      at
  com.ibm.jsse2.SSLSocketFactoryImpl.createSocket(SSLSocketFactory
  Impl.java:7)
  
  Other Error Information, as reported by customer:
  N/A
  

Local fix

• N/A
  

Problem summary

• AES-GCM in IBMPKCS11Impl is chosen even though it's not enabled
  in IBMPKCS11Impl
  
  
  ERROR DESCRIPTION:
  
  When specifying AES/GCM/NoPadding in Cipher.getInstance() while
  IBMPKCS11Impl provider is before IBMJCE provider in the provider
  list,  an  java.lang.UnsatisfiedLinkError exception was thrown.
  

Problem conclusion

• The Cipher service for algorithm AES has been updated in
  IBMPKCS11impl.
  
  The associated RTC PR is 84714
  The associated Austin CMVC defect is 116020
  The associated Austin APAR is IV69232
  
  JVMs affected : Java 7.0, Java 7.1 and Java 8.0
  
  The fix was delivered for Java 7.0 SR9, Java 7.1 SR3 and Java
  8.0 SR1
  
  The affected jar is "ibmpkcs11impl.jar".
  
  The build level of this jar for the affected releases is
  "20150202"
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TIVOLI JAVA PKC

• Fixed component ID

  TIVSECPKC

Applicable component levels

• R100 PSY

     UP