JDK-7027797 : take care of ECDH_anon/DH_anon server key exchange for TLS 1.2
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 6
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2011-03-15
  • Updated: 2016-06-21
  • Resolved: 2011-04-23
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7
6u115Fixed 7 b138Fixed
Related Reports
Relates :  
JDK-6916074 - Add support for TLS 1.2
Description
The preferable signature algorithm is not being set correctly for the ECDH_anon and DH_anon server key exchange algorithm in TLS version 1.2.

To reproduce, run the following JDK unit test:
       jdk/sun/security/pkcs11/sslecc/ClientJSSEServerJSSE.java

   :
   :
   :

 ** Failed TLS_ECDH_anon_WITH_AES_128_CBC_SHA in TLSv1.2 mode**

 STDERR:
 javax.net.ssl.SSLException: java.lang.NullPointerException
           at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
           at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1783)
           at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1743)
           at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1726)
           at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1652)
           at sun.security.ssl.AppInputStream.read(AppInputStream.java:113)
           at sun.security.ssl.AppInputStream.read(AppInputStream.java:69)
           at CipherTest$Server.handleRequest(CipherTest.java:77)
           at JSSEServer$1.run(JSSEServer.java:64)
           at
 java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
           at
 java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
           at java.lang.Thread.run(Thread.java:722)

 Caused by: java.lang.NullPointerException
           at
sun.security.ssl.HandshakeMessage$ECDH_ServerKeyExchange.send(HandshakeMessage.java:1137)
           at sun.security.ssl.HandshakeMessage.write(HandshakeMessage.java:141)
           at sun.security.ssl.ServerHandshaker.clientHello(ServerHandshaker.java:795)
           at
 sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:167)
           at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
           at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
           at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:963)
           at
 sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1259)
           at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:813)
           at sun.security.ssl.AppInputStream.read(AppInputStream.java:102)
           ... 6 more

 javax.net.ssl.SSLException: Received fatal alert: internal_error
           at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
           at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
           at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1854)
           at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1024)
           at
 sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1259)
           at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:677)
           at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:85)
           at java.io.OutputStream.write(OutputStream.java:75)
           at CipherTest$Client.sendRequest(CipherTest.java:265)
           at JSSEClient.runTest(JSSEClient.java:57)
           at CipherTest$Client.run(CipherTest.java:252)
           at java.lang.Thread.run(Thread.java:722)

 java.lang.Exception: *** Test 'Client JSSE - Server JSSE' failed ***
           at CipherTest.run(CipherTest.java:210)
           at CipherTest.main(CipherTest.java:332)
           at ClientJSSEServerJSSE.main(ClientJSSEServerJSSE.java:56)
Comments
EVALUATION For ECDH_anon and DH_anon, there is no signed value. That's to say that the signature bytes could be null for ECDH_anon and DH_anon cipher suites.
16-03-2011