From e333af0c8fbb8d69d79f420de01ce39dcade5930 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 24 Sep 2026 08:06:21 +0000
Subject: [PATCH] Keep PKCS5S2 usable on a FIPS-restricted JCE, and name the key wrapping property when the runtime has no RSA-OAEP (#1058)
---
opendj-server-legacy/src/main/java/org/opends/server/extensions/PKCS5S2PasswordStorageScheme.java | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/PKCS5S2PasswordStorageScheme.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/PKCS5S2PasswordStorageScheme.java
index 8b881cc..dbcd4fe 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/PKCS5S2PasswordStorageScheme.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/PKCS5S2PasswordStorageScheme.java
@@ -13,6 +13,7 @@
*
* Copyright 2014-2016 ForgeRock AS.
* Portions Copyright 2014 Emidio Stani & Andrea Stani
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.extensions;
@@ -85,13 +86,15 @@
{
try
{
- random = SecureRandom.getInstance(SECURE_PRNG_SHA1);
+ // The provider's default random source: a FIPS-restricted JCE registers no SHA1PRNG.
+ random = new SecureRandom();
// Just try to verify if the algorithm is supported
SecretKeyFactory.getInstance(MESSAGE_DIGEST_ALGORITHM_PBKDF2);
}
catch (NoSuchAlgorithmException e)
{
- throw new InitializationException(null);
+ throw new InitializationException(
+ ERR_PWSCHEME_CANNOT_INITIALIZE_MESSAGE_DIGEST.get(MESSAGE_DIGEST_ALGORITHM_PBKDF2, e), e);
}
}
@@ -246,8 +249,7 @@
{
try
{
- final SecureRandom random = SecureRandom.getInstance(SECURE_PRNG_SHA1);
- return encodeWithRandomSalt(plaintext, saltBytes, random);
+ return encodeWithRandomSalt(plaintext, saltBytes, new SecureRandom());
}
catch (DirectoryException e)
{
--
Gitblit v1.10.0