是否可以在JDK 1.7上将GCM与BC一起使用? [英] Is it possible to do use GCM with BC on JDK 1.7?
问题描述
我正在尝试使用任何AES GCM变体进行TLS连接,并且从我在文档中了解的内容来看,这应该是可能的,但出现此错误:
I'm trying to do a TLS connection using any of the AES GCM variants and from what I understand in the docs this should be possible but I get this error:
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1989)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1096)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1342)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1369)
问题是我尝试连接的服务器仅接受以下密码:
The problem is that the server I try to connect to only accepts these cyphers:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
<我尝试连接的服务器,但我尝试在github存储库上复制该问题。我找不到一个仅接受这些密码套件的服务器,这就是为什么我的存储库因另一个错误而失败的原因。
I cannot post here the server I try to connect to but I tried to replicate the issue on a github repo. I failed to find a server which only accepts these cypher suites that is why my repo fails with another error.
git clone https://github.com/andreicristianpetcu/gcm_with_bc_onjdk17
cd gcm_with_bc_onjdk17
JAVA_HOME="/usr/lib/jvm/java-7-openjdk-amd64/jre" mvn clean install
基本上这是来自GitHub的代码
Basically this it the code from GitHub
package com.github.gcm_with_bc_onjdk17;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;
import javax.net.ssl.SSLContext;
import java.io.IOException;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
public class GcmWithBouncyCasteleOnJDK17 {
public SSLConnectionSocketFactory getSslConnectionSocketFactory() throws NoSuchAlgorithmException, NoSuchProviderException, NoSuchPaddingException, KeyManagementException, IOException {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding", "BC");
System.out.println(cipher);
SSLContext sslContext = SSLContexts.custom()
.build();
SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
CloseableHttpClient httpClient = HttpClients.custom()
.setSSLSocketFactory(sslConnectionSocketFactory)
.build();
HttpGet out = new HttpGet("https://cloudflare.com/");
CloseableHttpResponse execute = httpClient.execute(out);
return sslConnectionSocketFactory;
}
}
谢谢
推荐答案
工作同事解决了这个问题:) 解决方法:
A work colleague figured out the issue :) here is the fix:
Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
Security.removeProvider(BouncyCastleJsseProvider.PROVIDER_NAME);
Security.insertProviderAt(new BouncyCastleProvider(), 0);
Security.insertProviderAt(new BouncyCastleJsseProvider(), 1);
似乎JDK7支持TLS 1.2,但不支持AES GCM密码。由于加密提供程序是一个列表,因此以某种方式选择了JDK提供程序,因为它支持TLS 1.2,即使它不支持所需的密码。只是将Bouncy Castle放在列表的上方即可解决此问题。
It seems that JDK7 supports TLS 1.2 but not the AES GCM ciphers. Since the cryptography providers are a list somehow the JDK provider was picked up since it supports TLS 1.2 even if it did not support the needed ciphers. Just putting Bouncy Castle a bit higher in the list fixed the issue.
我不知道为什么我的问题被否决了:(我不知道我违反了什么规则,所以
I have no clue why my question was down voted :( I have no clue what rules I broke so it got down voted, I even provided source code.
无论如何....很高兴我找到了解决方案,即使它不在Stack Overflow之外。后代。
Anyway.... super glad I found the fix even if it was outside of Stack Overflow. Leaving it here for posterity.
这篇关于是否可以在JDK 1.7上将GCM与BC一起使用?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!