From e333af0c8fbb8d69d79f420de01ce39dcade5930 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 24 Sep 2026 08:06:21 +0000
Subject: [PATCH] Keep PKCS5S2 usable on a FIPS-restricted JCE, and name the key wrapping property when the runtime has no RSA-OAEP (#1058)
---
opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java | 26 ++++++++++++++++++++++++++
1 files changed, 26 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java b/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
index c15db1c..4ab3d15 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
@@ -392,6 +392,9 @@
requestedKeyWrappingTransformation));
isAcceptable = false;
}
+ else if (!isKeyWrappingTransformationSupported(requestedKeyWrappingTransformation, unacceptableReasons)) {
+ isAcceptable = false;
+ }
else {
try {
/* Note that the TrustStoreBackend not available at initial,
@@ -430,6 +433,29 @@
return isAcceptable;
}
+ /**
+ * Checks that this Java runtime provides the key wrapping transformation. Only a refusal here
+ * names the key-wrapping-transformation property: the wrap which follows it also needs an MD5
+ * digest and a 1024-bit RSA key, and changing the property does not help when one of those is
+ * what the runtime refuses.
+ */
+ private static boolean isKeyWrappingTransformationSupported(
+ final String transformation, final List<LocalizableMessage> unacceptableReasons)
+ {
+ try
+ {
+ Cipher.getInstance(transformation);
+ return true;
+ }
+ catch (GeneralSecurityException ex)
+ {
+ logger.traceException(ex);
+ unacceptableReasons.add(
+ ERR_CRYPTOMGR_KEY_WRAPPING_TRANSFORMATION_UNSUPPORTED.get(transformation, getExceptionMessage(ex)));
+ return false;
+ }
+ }
+
@Override
public ConfigChangeResult applyConfigurationChange(CryptoManagerCfg cfg)
{
--
Gitblit v1.10.0