JDK-8216045 : The size of key_exchange may be wrong on FFDHE
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 11,12
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2019-01-03
  • Updated: 2020-11-23
  • Resolved: 2019-01-16
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 12 JDK 13 JDK 8 Other
11.0.4-oracleFixed 12 b29Fixed 13Fixed 8u261Fixed openjdk8u272Fixed
Description
The key_exchange for FFDHE groups size should be same as the associated prime size.
For example, The key_exchange for ffdhe2048 should be 2048-bit or 256-byte length.
But JSSE generates a 2048-byte key_exchange for this group, though the left 2048-256=1792 bytes just be zero-padded, like the below,
"ServerHello": {
  "server version"      : "TLSv1.2",
  "random"              : "90 F6 EA D5 14 78 AC 2A DD 8F CB 7A C0 79 65 4E 85 3A 72 1F FE 6D 63 71 8B 2F 3C 44 F5 23 2F C3",
  "session id"          : "",
  "cipher suite"        : "TLS_AES_128_GCM_SHA256(0x1301)",
  "compression methods" : "00",
  "extensions"          : [
    "supported_versions (43)": {
      "selected version": [TLSv1.3]
    },
    "key_share (51)": {
      "server_share": {
        "named group": ffdhe2048
        "key_exchange": {
          0000: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0010: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0020: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0030: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0040: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0060: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0070: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0080: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          00F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0100: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0110: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0120: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0130: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0140: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0150: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0160: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0170: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0180: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0190: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          01F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0200: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0210: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0220: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0230: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0240: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0250: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0260: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0270: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0280: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0290: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          02F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0300: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0310: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0320: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0330: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0340: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0350: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0360: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0370: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0380: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0390: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          03F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0400: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0410: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0420: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0430: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0440: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0450: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0460: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0470: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0480: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0490: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          04F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0500: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0510: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0520: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0530: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0540: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0550: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0560: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0570: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0580: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0590: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          05F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0600: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0610: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0620: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0630: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0640: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0650: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0660: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0670: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0680: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0690: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06A0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06B0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06C0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06D0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06E0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          06F0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00  ................
          0700: 03 D3 A2 5B CE 28 81 20   04 B1 F3 6E 47 D9 A5 3B  ...[.(. ...nG..;
          0710: 30 2E 13 29 48 93 BA ED   AA A2 AC 96 A6 37 70 E1  0..)H........7p.
          0720: 64 18 97 D7 1C 25 43 82   1B 4C 5E 7D 64 EB EF FB  d....%C..L^.d...
          0730: 00 71 77 95 D5 6A CE E3   95 5C 2A 7F DC 60 89 65  .qw..j...\*..`.e
          0740: 37 3C AF DB D6 BC 29 37   B7 D8 9F F4 F0 51 09 70  7<....)7.....Q.p
          0750: B0 B6 A7 91 42 28 E1 7A   C2 C2 97 00 BC 61 61 54  ....B(.z.....aaT
          0760: AA CB C8 07 03 BC F4 08   34 1E B4 6A 15 A5 00 7C  ........4..j....
          0770: 57 7F CC 2D 9A BC AA 07   35 2B 60 36 4F 40 DB 42  W..-....5+`6O@.B
          0780: D9 3D 9C E2 9B 72 B9 06   D8 9C CC 0F 82 D0 7F 83  .=...r..........
          0790: D8 60 50 F1 CD 6A 5D AC   11 EE CF 8F 0D 34 61 F8  .`P..j]......4a.
          07A0: 1E 99 10 99 14 A7 42 9B   1A 87 4B E3 B1 0D A7 4C  ......B...K....L
          07B0: 09 C4 99 C1 83 0B 99 E9   AF 66 45 86 DB 90 59 9F  .........fE...Y.
          07C0: 51 C3 B3 94 5B 17 C6 2D   96 87 03 6A 36 15 1A F7  Q...[..-...j6...
          07D0: B3 34 93 E8 33 A9 7E 3F   8F 03 5A F1 23 DE B2 C7  .4..3..?..Z.#...
          07E0: BF E1 4C 09 82 CC 46 8B   CF 2C 5A 7F 45 B2 55 9B  ..L...F..,Z.E.U.
          07F0: 1C 5D 24 75 AA 61 C2 8B   E8 61 B9 32 15 81 F7 0A  .]$u.a...a.2....
        }
      },
    }
  ]
}
Comments
Fix Request Backporting this patch fixes a corner case in FFDHE TLS, and keeps codebases in sync across releases (I see 11.0.4-oracle). Patch applies cleanly to 11u and passes jdk_security tests.
13-03-2019
No new unit test, the existing infra testing and fuzzing testing covered the case.
15-01-2019