PH63162: IBMJCEHYBRID FAILS TO HANDLE EC ALGORITHM PARAMETERS

APAR status

• Closed as program error.

Error description

• Error Message: After upgrading to Java8 SR8FP30 getting
  IBMJCEHybridException: Failover exhausted, all registered
  providers attempted and failed, for TLS connections.
  .
  Stack Trace: IBMJCEHybridException: Failover exhausted, all
  registered providers attempted and failed.
  Exception#0 java.security.spec.InvalidParameterSpecException:
  not initialized
  Stack Trace:
          at
  java.security.AlgorithmParameters.getParameterSpec(AlgorithmPara
  
  meter s.java:353)
          at
  com.ibm.crypto.ibmjcehybrid.provider.HybridAlgorithmParameters.g
  
  etPar ameterSpec(HybridAlgorithmParameters.java:645)
          at
  com.ibm.crypto.ibmjcehybrid.provider.HybridAlgorithmParameters.g
  
  etPar ameterSpec(HybridAlgorithmParameters.java:691)
          at
  com.ibm.crypto.ibmjcehybrid.provider.HybridAlgorithmParameters.g
  
  etPar ameterSpec(HybridAlgorithmParameters.java:691)
          at com.ibm.crypto.ibmjcehybri
  .
  This only happens when adding IBMJCEHYBRID as first provider for
  
  SR8FP30.
  

Local fix

• The error can be skipped by removing IBMJCEHYBRID from the
  provider list.
  Note that IBMJCEHYBRID provides a failover mechanism in case of
  hardware/software crypto operation errors.
  Removing IBMJCEHYBRID allows JSSE and EC to work, but the
  IBMJCEHYBRID failover mechanism is not available.
  

Problem summary

• After upgrading to Java8 SR8FP30, users may encounter
  "IBMJCEHybridException: Failover exhausted, all registered
  providers attempted and failed" for TLS connections with
  IBMJCEHYBRID as the first provider.
  

Problem conclusion

• The IBMJCEHYBRID EC Algorithm Parameters have been changed to
  properly initialize both supported and unsupported EC algorithm
  parameters.
  .
  This APAR will be fixed in the following Releases:
  .
  IBM SDK, Java Technology Edition
    8    SR8 FP32  (8.0.8.32)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For the z/OS operating system:
   - Java SDK Products on z/OS
     https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels