migrating from jdk10 to jdk11 : SSLConnection : CKR_KEY_TYPE_INCONSISTENT

Question

I migrated my client application from openJDK 10 to 11 (JAVA_VERSION="11.0.12") but at runtime, during TLS handhshake, i've got this exception :

javax.net.ssl|ALL|01|main|2021-11-24 10:55:54.848 CET|SignatureScheme.java:592|Ignore unsupported signature algorithm (rsa_pkcs1_sha256) ( "throwable" : { java.security.InvalidKeyException: No installed provider supports this key: sun.security.pkcs11.P11Key$P11PrivateKey at java.base/java.security.Signature$Delegate.chooseProvider(Signature.java:1282) at java.base/java.security.Signature$Delegate.engineInitSign(Signature.java:1380) at java.base/java.security.Signature.initSign(Signature.java:682) at java.base/java.security.Signature$1.initSign(Signature.java:146) at java.base/sun.security.util.SignatureUtil.initSignWithParam(SignatureUtil.java:171) at java.base/sun.security.ssl.SignatureScheme.getSigner(SignatureScheme.java:584) at java.base/sun.security.ssl.SignatureScheme.getSignerOfPreferableAlgorithm(SignatureScheme.java:532) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyMessage.(CertificateVerify.java:590) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyProducer.produce(CertificateVerify.java

....

javax.net.ssl|ALL|01|main|2021-11-24 10:55:54.850 CET|SignatureScheme.java:592|Ignore unsupported signature algorithm (rsa_pkcs1_sha384) ( "throwable" : { java.security.InvalidKeyException: No installed provider supports this key: sun.security.pkcs11.P11Key$P11PrivateKey at java.base/java.security.Signature$Delegate.chooseProvider(Signature.java:1282) at java.base/java.security.Signature$Delegate.engineInitSign(Signature.java:1380) at java.base/java.security.Signature.initSign(Signature.java:682) at java.base/java.security.Signature$1.initSign(Signature.java:146) at java.base/sun.security.util.SignatureUtil.initSignWithParam(SignatureUtil.java:171) at java.base/sun.security.ssl.SignatureScheme.getSigner(SignatureScheme.java:584) at java.base/sun.security.ssl.SignatureScheme.getSignerOfPreferableAlgorithm(SignatureScheme.java:532) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyMessage.(CertificateVerify.java:590) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyProducer.produce(CertificateVerify.java:761)

....

javax.net.ssl|WARNING|01|main|2021-11-24 10:55:55.228 CET|SSLSocketImpl.java:1505|handling exception ( "throwable" : { java.security.ProviderException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_KEY_TYPE_INCONSISTENT at jdk.crypto.cryptoki/sun.security.pkcs11.P11Signature.engineSign(P11Signature.java:679) at java.base/java.security.Signature$Delegate.engineSign(Signature.java:1402) at java.base/java.security.Signature.sign(Signature.java:711) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyMessage.(CertificateVerify.java:609) at java.base/sun.security.ssl.CertificateVerify$T12CertificateVerifyProducer.produce(CertificateVerify.java:761) at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:436) at java.base/sun.security.ssl.ServerHelloDone$ServerHelloDoneConsumer.consume(ServerHelloDone.java:182)

In debug mode, with -Djavax.net.debug=all argument. I see this difference but i don't know if it's interesting.

JDK11

javax.net.ssl|DEBUG|01|main|2021-11-24 10:55:54.687 CET|ClientHello.java:653|Produced ClientHello handshake message (
"ClientHello": {
  "client version"      : "TLSv1.2",
  "random"              : "74 E9 F0 E2 E6 18 44 A4 BD 5C 8E 5F 11 BB AE 98 15 13 0F F0 E9 93 6D B3 B4 08 EE 6A 9E B9 39 8B",
  "session id"          : "",
  "cipher suites"       : "[TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384(0xC02E), TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384(0xC032), TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x009F), TLS_DHE_DSS_WITH_AES_256_GCM_SHA384(0x00A3), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256(0xC02D), TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256(0xC031), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256(0x009E), TLS_DHE_DSS_WITH_AES_128_GCM_SHA256(0x00A2), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384(0xC024), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384(0xC028), TLS_RSA_WITH_AES_256_CBC_SHA256(0x003D), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384(0xC026), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384(0xC02A), TLS_DHE_RSA_WITH_AES_256_CBC_SHA256(0x006B), TLS_DHE_DSS_WITH_AES_256_CBC_SHA256(0x006A), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA(0xC00A), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA(0xC005), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA(0xC00F), TLS_DHE_RSA_WITH_AES_256_CBC_SHA(0x0039), TLS_DHE_DSS_WITH_AES_256_CBC_SHA(0x0038), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256(0xC023), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256(0xC027), TLS_RSA_WITH_AES_128_CBC_SHA256(0x003C), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256(0xC025), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256(0xC029), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256(0x0067), TLS_DHE_DSS_WITH_AES_128_CBC_SHA256(0x0040), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA(0xC009), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA(0xC004), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA(0xC00E), TLS_DHE_RSA_WITH_AES_128_CBC_SHA(0x0033), TLS_DHE_DSS_WITH_AES_128_CBC_SHA(0x0032), TLS_EMPTY_RENEGOTIATION_INFO_SCSV(0x00FF)]",
  "compression methods" : "00",
  "extensions"          : [
    "server_name (0)": {
      type=host_name (0), value=ws.test.annuaireamc.fr
    },
    "status_request (5)": {
      "certificate status type": ocsp
      "OCSP status request": {
        "responder_id": <empty>
        "request extensions": {
          <empty>
        }
      }
    },
    "supported_groups (10)": {
      "versions": [x25519, secp256r1, secp384r1, secp521r1, x448, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192]
    },
    "ec_point_formats (11)": {
      "formats": [uncompressed]
    },
    "signature_algorithms (13)": {
      "signature schemes": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, ecdsa_sha224, rsa_sha224, dsa_sha224, ecdsa_sha1, rsa_pkcs1_sha1, dsa_sha1]
    },
    "signature_algorithms_cert (50)": {
      "signature schemes": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, ecdsa_sha224, rsa_sha224, dsa_sha224, ecdsa_sha1, rsa_pkcs1_sha1, dsa_sha1]
    },
    "status_request_v2 (17)": {
      "cert status request": {
        "certificate status type": ocsp_multi
        "OCSP status request": {
          "responder_id": <empty>
          "request extensions": {
            <empty>
          }
        }
      }
    },
    "extended_master_secret (23)": {
      <empty>
    },
    "supported_versions (43)": {
      "versions": [TLSv1.2]
    }
  ]
}

JDK10 :

*** ClientHello, TLSv1.2
RandomCookie:  random_bytes = {82 D7 E3 A8 48 D6 9D 36 FF 54 0B 1A 75 C5 58 1E B9 C0 E8 8D E3 B8 53 73 3B C1 65 F4 A1 E4 DD 12}
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension supported_groups, group names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension extended_master_secret
Extension server_name, server_name: [type=host_name (0), value=ws.test.annuaireamc.fr]
Extension status_request_v2
CertStatusReqItemV2: ocsp_multi, OCSPStatusRequest
    ResponderIds: <EMPTY>
    Extensions: <EMPTY>
CertStatusReqItemV2: ocsp, OCSPStatusRequest
    ResponderIds: <EMPTY>
    Extensions: <EMPTY>
Extension status_request: ocsp, OCSPStatusRequest
    ResponderIds: <EMPTY>
    Extensions: <EMPTY>
***

I use a client certificate stored in card.

I add "SunPKCS11" provider and with the command line Djava.security.debug=sunpkcs11 i have this information with Java11 :

    Library info:
  cryptokiVersion: 2.20
  manufacturerID: manufacturer                     
  flags: 0
  libraryDescription: CPS3 PKCS#11 MACOSX             
  libraryVersion: 2.07
All slots: 0
Slots with tokens: 0
Slot info for slot 0:
  slotDescription: PSS Reader on CPS                                               
  manufacturerID:                                 
  flags: CKF_TOKEN_PRESENT | CKF_REMOVABLE_DEVICE | CKF_HW_SLOT
  hardwareVersion: 0.00
  firmwareVersion: 0.00
Token info for token in slot 0:
  label: CPS3v3-2800385098               
  manufacturerID: manufacturer                     
  model: IAS ECC?????????
  serialNumber: 99225468       
  flags: CKF_RNG | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_TOKEN_INITIALIZED
  ulMaxSessionCount: CK_EFFECTIVELY_INFINITE
  ulSessionCount: 0
  ulMaxRwSessionCount: CK_EFFECTIVELY_INFINITE
  ulRwSessionCount: 0
  ulMaxPinLen: 4
  ulMinPinLen: 4
  ulTotalPublicMemory: CK_UNAVAILABLE_INFORMATION
  ulFreePublicMemory: CK_UNAVAILABLE_INFORMATION
  ulTotalPrivateMemory: CK_UNAVAILABLE_INFORMATION
  ulFreePrivateMemory: CK_UNAVAILABLE_INFORMATION
  hardwareVersion: 0.00
  firmwareVersion: 0.00
  utcTime: ????????????????
Mechanism CKM_SHA_1:
  ulMinKeySize: 0
  ulMaxKeySize: 0
  flags: 1024 = CKF_DIGEST
Mechanism CKM_SHA256:
  ulMinKeySize: 0
  ulMaxKeySize: 0
  flags: 1024 = CKF_DIGEST
Mechanism CKM_RSA_X_509:
  ulMinKeySize: 512
  ulMaxKeySize: 2048
  flags: 272897 = CKF_HW | CKF_DECRYPT | CKF_SIGN | CKF_VERIFY | CKF_UNWRAP
DISABLED due to legacy
Mechanism CKM_RSA_PKCS:
  ulMinKeySize: 512
  ulMaxKeySize: 2048
  flags: 272897 = CKF_HW | CKF_DECRYPT | CKF_SIGN | CKF_VERIFY | CKF_UNWRAP
DISABLED due to legacy
Mechanism CKM_SHA1_RSA_PKCS:
  ulMinKeySize: 512
  ulMaxKeySize: 2048
  flags: 10240 = CKF_SIGN | CKF_VERIFY
Mechanism CKM_SHA256_RSA_PKCS:
  ulMinKeySize: 512
  ulMaxKeySize: 2048
  flags: 10240 = CKF_SIGN | CKF_VERIFY
DISABLED in configuration

So, if i display the available algorthims, i've got less algorthims in java 11 than in java 10.

In java 11 :

Service Type: MessageDigest Algorithm SHA1
Service Type: KeyStore Algorithm PKCS11
Service Type: Signature Algorithm SHA1withRSA
Service Type: MessageDigest Algorithm SHA-256
Service Type: SecureRandom Algorithm PKCS11

In java 10 :

Service Type: Signature Algorithm MD2withRSA
Service Type: Cipher Algorithm RSA/ECB/NoPadding
Service Type: Signature Algorithm SHA224withRSA
Service Type: Signature Algorithm SHA512withRSA
Service Type: Signature Algorithm SHA1withRSA
Service Type: KeyFactory Algorithm RSA
Service Type: Signature Algorithm SHA384withRSA
Service Type: Signature Algorithm MD5withRSA
Service Type: Cipher Algorithm RSA/ECB/PKCS1Padding
Service Type: MessageDigest Algorithm SHA-256
Service Type: MessageDigest Algorithm SHA1
Service Type: Signature Algorithm SHA256withRSA
Service Type: SecureRandom Algorithm PKCS11
Service Type: KeyStore Algorithm PKCS11

Do i need to modify java.security file ? What is the difference between rsa_pkcs1_sha256 and SHA256withRSA ? Is the problem come from provider and "DISABLED due to legacy" ? Is it possible to force "DISABLED due to legacy" algorithm ?

I would start to verify your TLS settings using https://www.ssllabs.com/ssltest/ — Tore Nestenius, Nov 27 '21 at 13:46
Hi @ToreNestenius, it's a client application. Do you want settings about the server i'm connecting to? I add information about new investigation in my post. — Fabian Monnay, Nov 29 '21 at 13:38
You are correct that newer version of Java has less ciphers to choose from, as they remove ciphers that are no longer considered secure. Older versions of Java might have trouble to connect to modern and more secure versions of TLS , as they might lack support for the more modern ciphers and protocols. — Tore Nestenius, Nov 29 '21 at 14:18
Does https://stackoverflow.com/questions/34609384/how-to-set-tls1-2-version-in-java help you? — Tore Nestenius, Nov 29 '21 at 14:18
If I look at https://www.ssllabs.com/ssltest/analyze.html?d=ws.test.annuaireamc.fr then that TLS configuration seems a bit insecure — Tore Nestenius, Nov 29 '21 at 14:19

score 1 · Answer 1 · answered Jun 27 '22 at 16:40

I think it's due to security improvments in SunPKCS11.java, not only JDK11 but also in JDK8, and I think all of them. They add a new function :

private static boolean isLegacy(CK_MECHANISM_INFO mechInfo)
        throws PKCS11Exception {
    // assume full support if no mech info available
    // For vendor-specific mechanisms, often no mech info is provided
    boolean partialSupport = false;

    if (mechInfo != null) {
        if ((mechInfo.flags & CKF_DECRYPT) != 0) {
            // non-legacy cipher mechs should support encryption
            partialSupport |= ((mechInfo.flags & CKF_ENCRYPT) == 0);
        }
        if ((mechInfo.flags & CKF_VERIFY) != 0) {
            // non-legacy signature mechs should support signing
            partialSupport |= ((mechInfo.flags & CKF_SIGN) == 0);
        }
    }
    return partialSupport;
}

Mechanisms such as "CKM_RSA_PKCS" are disabled since they set the flag "CKF_DECRYPT" without setting "CKF_ENCRYPT". It's legacy according to Java, but mandatory according to IAS-ECC specifications.

I have not found any workaround yet. Have you?

it's true for master branch of OpenJDK 8 https://github.com/openjdk/jdk8u/blob/master/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java#L890 — David KELLER, Jan 09 '23 at 20:57

score 0 · Answer 2 · answered Jan 09 '23 at 21:59

On jdk8u322-ga tag, you still have isLegacy() https://github.com/openjdk/jdk8u/blob/jdk8u322-ga/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java

On jdk8u312-ga tag, there is no isLegacy() function https://github.com/openjdk/jdk8u/blob/jdk8u312-ga/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java

So the last build without this function is https://github.com/AdoptOpenJDK/openjdk8-upstream-binaries/releases/tag/jdk8u312-b07

Now, it is important to understand why OpenJDK add this new constraint incompatible with IAS-ECC specifications.

migrating from jdk10 to jdk11 : SSLConnection : CKR_KEY_TYPE_INCONSISTENT

2 Answers2