JDK-8244648 : SunMSCAPI is dependent on ncrypt.dll since 8u251
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 8u251
  • Priority: P3
  • Status: Resolved
  • Resolution: Won't Fix
  • OS: windows
  • CPU: x86_64
  • Submitted: 2020-05-08
  • Updated: 2022-04-19
  • Resolved: 2022-04-19
Related Reports
Duplicate :  
JDK-8256064 - After updating to 8u251, Applications fail- sunmscapi.dll: Can't find dependency
Duplicate :  
JDK-8244972 - SunMSCAPI is unexpectedly dependent on ncrypt.dll
Description
FULL PRODUCT VERSION :
8 Update 251

FULL OS VERSION :
Windows Embedded POSReady 2009 x86

A DESCRIPTION OF THE PROBLEM :
As we rolled out the new update to our Windows Embedded POSReady 2009 tills we noticed that sunmscapi.dll was changed and is now calling ncrypt.dll which represents a problem as those APIs don't exist in our Embedded version of Windows. After we rolled out the update, we replaced sunmscapi.dll from the earlier release. This way, we managed to get Java 8 Update 251 work. This issue breaks Embedded products compatibility.

STEPS TO REPRODUCE THE PROBLEM :
Try to run Java 8 Update 251 on a Windows Embedded POSReady 2009 x86 machine.

JAVA CONSOLE INFORMATION :
You can easily see the missing APIs from Dependency Walker.
Comments
Windows XP EOL'd in April 2014. https://www.microsoft.com/en-us/microsoft-365/windows/end-of-windows-xp-support Windows Embedded POSReady 2009 is based on XP, and is unsupported as of April 2019. https://docs.microsoft.com/en-us/lifecycle/announcements/windows-embedded-2009-end-of-support Java hasn't supported XP since the July 2014 updates. It might work, but no guarantees. https://www.java.com/en/download/faq/winxp.xml SunMSCAPI was enhanced to support RSSSA-PSS which is a new feature in 8u251, and is used in the upcoming TLSv1.3 implementation. The Windows native PSS is only supported in ncrypt, which is why we introduced the dependency since XP is no longer supported. Using the old sunmscapi.jar with the new DLLs certainly has never been tested, and would be completely unsupported. PSS should still work when using the Java provider SunRSASign.
13-05-2020