JDK-8228645 : Don't run sun/security/pkcs11/Cipher/TestKATForGCM.java on buggy NSS solaris versions
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.crypto:pkcs11
  • Affected Version: 11,14
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: solaris
  • Submitted: 2019-07-26
  • Updated: 2023-10-03
  • Resolved: 2019-07-29
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 14 JDK 8
11.0.6-oracleFixed 14 b08Fixed 8u401Fixed
Related Reports
Relates :  
JDK-8080462 - Update SunPKCS11 provider with PKCS11 v2.40 support
Description
sun/security/pkcs11/Cipher/TestKATForGCM.java was a new testcase added for JDK-8080462. Turns out that it can fail due to NSS issue on older solaris versions :

javax.crypto.BadPaddingException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ENCRYPTED_DATA_INVALID
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11AEADCipher.handleException(P11AEADCipher.java:723)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11AEADCipher.implDoFinal(P11AEADCipher.java:612)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11AEADCipher.engineDoFinal(P11AEADCipher.java:524)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11AEADCipher.engineDoFinal(P11AEADCipher.java:510)
	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2202)
	at TestKATForGCM.execute(TestKATForGCM.java:267)
	at TestKATForGCM.main(TestKATForGCM.java:317)
	at PKCS11Test.premain(PKCS11Test.java:180)
	at PKCS11Test.testNSS(PKCS11Test.java:560)
	at PKCS11Test.main(PKCS11Test.java:216)
	at TestKATForGCM.main(TestKATForGCM.java:303)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at com.sun.javatest.regtest.agent.MainActionHelper$SameVMRunnable.run(MainActionHelper.java:229)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ENCRYPTED_DATA_INVALID
	at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_Decrypt(Native Method)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11AEADCipher.implDoFinal(P11AEADCipher.java:605)
	... 15 more

I think it's best to have the test run on newer Solaris versions (i.e. 11.3 and later) - the NSS version on Solaris 11.3 is 3.251
Comments
Fix request (11u) I would like to downport this for parity with 11.0.6-oracle. Applies clean.
19-11-2019
URL: https://hg.openjdk.java.net/jdk/jdk/rev/2116221e2dde User: coffeys Date: 2019-07-29 08:17:58 +0000
29-07-2019