PH53918: UNSUPPORTEDOPERATIONEXCEPTION WHEN CREATING LTPA KEYS AFTER MOVING TO 22.0.0.12 WITH JAVA 11 ON Z/OS

APAR status

• Closed as program error.

Error description

• After moving to 22.0.0.12 with Java 11, the following exception
  may be seen when the server generates LTPA keys on startup:
  .
  java.lang.UnsupportedOperationException: Hardware error,
  function getPrivateExponent has no meaning in hardware
  at ibm.crypto.hdwrcca/com.ibm.crypto.hdwrCCA.provider.RSAPriva
  teHWKey.getPrivateExponent(RSAPrivateHWKey.java:86)
  at com.ibm.ws.crypto.ltpakeyutil.LTPACrypto.rsaKey(LTPACrypto.
  java:1058)
  at com.ibm.ws.crypto.ltpakeyutil.LTPADigSignature.generateRSAK
  eys(LTPADigSignature.java:49)
  at com.ibm.ws.crypto.ltpakeyutil.LTPADigSignature.generateLTPA
  KeyPair(LTPADigSignature.java:76)
  at com.ibm.ws.crypto.ltpakeyutil.LTPAKeyFileUtilityImpl.genera
  teLTPAKeys(LTPAKeyFileUtilityImpl.java:50)
  at com.ibm.ws.security.token.ltpa.internal.LTPAKeyFileCreatorI
  mpl.createLTPAKeysFile(LTPAKeyFileCreatorImpl.java:62)
  ...
  This problem only occurs when using IBMJCECCA as a provider on
  Java 11.
  

Local fix

• Use OpenJCEPlus as the provider by editing the java.security
  file and setting it as the top provider:
  
  security.provider.1=IBMJCECCA      <---- Remove this or swap it
                                         for security.provider.2
  
  security.provider.2=OpenJCEPlus    <----
  
  security.provider.3=IBMZSecurity
  
  security.provider.4=SUN
  
  security.provider.5=SunRsaSign
  ...
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty who configures Hardware      *
  *                  Crypto providers in java.security file      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When the server generates LTPA keys on  *
  *                      startup,                                *
  *                      java.lang.UnsupportedOperationException *
  *                      is thrown.                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The above error is thrown when the server starts up. As a
  result, LTPA authentication is unavailable.
  

Problem conclusion

• The bug has been fixed. For more details, please refer to the
  following Pull Request:
  https://github.com/OpenLiberty/open-liberty/issues/24955
  
  The fix for this APAR is targeted for inclusion in fix pack
  23.0.0.5. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

• In java.security file, place JCE provider above the Hardware
  provider.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROF -

• Fixed component ID

  5655W6514

Applicable component levels