JDK-8176183 : sun/security/mscapi/SignedObjectChain.java fails on Windows
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 9
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2017-03-06
  • Updated: 2019-01-14
  • Resolved: 2017-03-09
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 10 JDK 7 JDK 8 JDK 9 Other
10Fixed 7u191Fixed 8u181Fixed 9 b161Fixed openjdk7uFixed
Related Reports
Relates :  
JDK-8182386 - Crypto keys should be compatible between security providers
Relates :  
JDK-8176182 - 4 security tests are not run
Relates :  
JDK-8050374 - More Signature tests
Description
sun/security/mscapi/SignedObjectChain.java fails at windows (and this test is windows-only test), reproducible.

Note that though this test was introduced in JDK-8050374, but due to missed @run tag, test is not run. After added @run (JDK-8176182), the failure shows up.

ACTION: main -- Failed. Execution failed: `main' threw exception: java.lang.RuntimeException: Some tests failed
REASON: User specified action: run main SignedObjectChain 
TIME:   12.157 seconds
...
STDOUT:
Test: provider = SunMSCAPI, signature algorithm = MD2withRSA, key algorithm = RSA
Unexpected exception: java.security.InvalidKeyException: Key type not supported
java.security.InvalidKeyException: Key type not supported
	at jdk.crypto.mscapi/sun.security.mscapi.RSASignature.engineInitSign(RSASignature.java:287)
	at java.base/java.security.Signature$Delegate.engineInitSign(Signature.java:1200)
	at java.base/java.security.Signature.initSign(Signature.java:545)
	at java.base/java.security.SignedObject.sign(SignedObject.java:243)
	at java.base/java.security.SignedObject.<init>(SignedObject.java:161)
	at Chain.runTest(Chain.java:167)
	at SignedObjectChain.lambda$main$0(SignedObjectChain.java:52)
	at java.base/java.util.stream.MatchOps$1MatchSink.accept(MatchOps.java:90)
	at java.base/java.util.Spliterators$ArraySpliterator.tryAdvance(Spliterators.java:958)
	at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:127)
	at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:502)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:488)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
	at java.base/java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:230)
	at java.base/java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:196)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.allMatch(ReferencePipeline.java:466)
	at SignedObjectChain.main(SignedObjectChain.java:51)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:547)
	at com.sun.javatest.regtest.agent.MainActionHelper$SameVMRunnable.run(MainActionHelper.java:230)
	at java.base/java.lang.Thread.run(Thread.java:844)
STDERR:
java.lang.RuntimeException: Some tests failed
	at SignedObjectChain.main(SignedObjectChain.java:57)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:547)
	at com.sun.javatest.regtest.agent.MainActionHelper$SameVMRunnable.run(MainActionHelper.java:230)
	at java.base/java.lang.Thread.run(Thread.java:844)
Comments
Code review: http://mail.openjdk.java.net/pipermail/security-dev/2017-March/015670.html
08-03-2017
"Key type not supported" error comes from sun/security/mscapi/RSASignature.java: http://hg.openjdk.java.net/jdk9/dev/jdk/file/314a7c2356c3/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/RSASignature.java#l282 ... // initialize for signing. See JCA doc protected void engineInitSign(PrivateKey key) throws InvalidKeyException { // This signature accepts only RSAPrivateKey if ((key instanceof sun.security.mscapi.RSAPrivateKey) == false) { throw new InvalidKeyException("Key type not supported"); } privateKey = (sun.security.mscapi.RSAPrivateKey) key; ... engineInitSign() method above requires "key" to be an instance of sun.security.mscapi.RSAPrivateKey. But Chain.java which is used in SignedObjectChain.java uses KeyPairGenerator with default security provider. As a result, "Key type not supported" error occures because SunJCE provider is used by default, and it doens't return an instance of sun.security.mscapi.RSAPrivateKey: http://hg.openjdk.java.net/jdk9/dev/jdk/file/314a7c2356c3/test/java/security/SignedObject/Chain.java#l140 ... KeyPairGenerator kpg = KeyPairGenerator.getInstance( test.keyAlg.name); ... Signature signature; if (test.provider != Provider.Default) { signature = Signature.getInstance(test.sigAlg.name, test.provider.name); } else { signature = Signature.getInstance(test.sigAlg.name); } ... We don't specify a security provider in KeyPairGenerator.getInstance() call, so default one is used. But we set a security provider (SunMSCAPI in this case) for Signature.getInstance(). It looks like a test bug. The test should use specified security provider for both key generation and signing. But on the other hand, it looks a little strange that sun.security.mscapi.RSASignature requires an instance of sun.security.mscapi.RSAPrivateKey. RSA key should contain the same info regardless what class/object is actually contains it.
08-03-2017
Note that test is problem listed, please remember to remove it from ProblemList.txt with this (JDK-8176183) fix.
06-03-2017