PH66176: OPENJCEPLUS REPORTS INCORRECT BLOCK SIZE FOR PASSWORD-BASED ENCRYPTION (PBE) ALGORITHM

APAR status

• Closed as program error.

Error description

• Error Message: Suppose a user tries to use PBE
  Cipher.getBlockSize() to set it as the IV length to pass to the
  PBE Cipher. In that case, it gets the
  "java.security.InvalidAlgorithmParameterException: IV must be 16
  bytes" exception message.
  .
  Stack Trace: java.security.InvalidAlgorithmParameterException:
  IV must be 16 bytes
      at com.ibm.crypto.plus.provider.PBE2Cipher.internalInit()
      at com.ibm.crypto.plus.provider.PBE2Cipher.engineInit()
      at javax.crypto.Cipher.implInit()
      at javax.crypto.Cipher.chooseProvider()
      at javax.crypto.Cipher.init()
      at javax.crypto.Cipher.init()
  .
  

Local fix

• As a workaround, a wrapper method or class can be used to return
  the right block size based on the PBE algorithm.
  

Problem summary

• The OpenJCEPlus provider inaccurately reports the block size for
  
  
  Password-Based Encryption (PBE) algorithms that use AES as the
  cipher algorithm, stating it as 8 instead of the correct value
  of 16.
  

Problem conclusion

• The Password-Based Encryption (PBE) implementation in the
  OpenJCEPlus was changed to report the correct block size.
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
   21              21.0.7.0
   17              17.0.15.0
   11              11.0.27.0
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For the z/OS operating system:
  - Java SDK Products on z/OS
    https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels