PH61294: UNSUPPORTEDOPERATIONEXCEPTION: HARDWARE ERROR, FUNCTION GETMODULUS HAS NO MEANING IN HARDWARE

APAR status

• Closed as Permanent restriction.

Error description

• Error Message: java.lang.UnsupportedOperationException: Hardware
  error, function getModulus has no meaning in hardware
  .
  Stack Trace: java.lang.UnsupportedOperationException: Hardware
  error, function getModulus has no meaning in hardware
        at
  com.ibm.crypto.hdwrCCA.provider.RSAPrivateHWKey.getModulus(RSAPr
  ivateHWKey.java:13)
        at com.ibm.crypto.fips.provider.RSACipher.a(Unknown
  Source)
        at com.ibm.crypto.fips.provider.RSACipher.a(Unknown
  Source)
        at
  com.ibm.crypto.fips.provider.RSACipher.engineInit(Unknown
  Source)
        at javax.crypto.Cipher.init(Unknown Source)
        at javax.crypto.Cipher.init(Unknown Source)
        at
  com.ibm.jsse2.RSAKeyExchange$RSAPremasterSecret.decode(RSAKeyExc
  hange.java:148)
        at
  com.ibm.jsse2.RSAClientKeyExchange$RSAClientKeyExchangeConsumer.
  consume(RSAClientKeyExchange.java:282)
        at
  com.ibm.jsse2.ClientKeyExchange$ClientKeyExchangeConsumer.consum
  e(ClientKeyExchange.java:105)
        at
  com.ibm.jsse2.SSLHandshake.consume(SSLHandshake.java:371)
        at
  com.ibm.jsse2.HandshakeContext.dispatch(HandshakeContext.java:67
  2)
        at
  com.ibm.jsse2.HandshakeContext.dispatch(HandshakeContext.java:65
  0)
        at
  com.ibm.jsse2.TransportContext.dispatch(TransportContext.java:19
  5)
        at
  com.ibm.jsse2.SSLTransport.decode(SSLTransport.java:149)
        at
  com.ibm.jsse2.SSLSocketImpl.decode(SSLSocketImpl.java:1316)
        at
  com.ibm.jsse2.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.ja
  va:1229)
        at
  com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:41
  3)
        at
  com.ibm.jsse2.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:
  833)
        at
  com.ibm.jsse2.SSLSocketImpl.access$200(SSLSocketImpl.java:72)
        at
  com.ibm.jsse2.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.ja
  va:919)
        at com.ibm.ws.io.Stream.read(Stream.java:17)
        at
  com.ibm.ws.io.ReadStream.readBuffer(ReadStream.java:421)
        at com.ibm.ws.io.ReadStream.read(ReadStream.java:113)
        at
  com.ibm.ws.http.HttpRequest.readRequestLine(HttpRequest.java:341
  )
        at
  com.ibm.ws.http.HttpRequest.readRequest(HttpRequest.java:307)
        at
  com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnecti
  on.java:687)
        at
  com.ibm.ws.http.HttpConnection.run(HttpConnection.java:522)
        at
  com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1892)}
  .
  

Local fix

• The workaround is to not use a non-FIPS (IBMJCECCA) provider in
  conjunction with a FIPS environment.
  Another option is to replace the IBMJCEFIPS provider with IBMJCE
  in Java 8 instead as this will not call getModulus().
  

Problem summary

• IBMJCECCA does not support getModulus(). IBMJCECCA is not a FIPS
  compliant provider so IBMJCEFIPS cannot be used, that is also
  the case for all Non-FIPS providers (there is no FIPS provider
  in the zOS Semeru versions).
  

Problem conclusion

• This is a permenant restriction.
  

Temporary fix

• Remove the usage of hardware (IBMJCECCA) when using IBMJCEFIPS.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels