CODEWITHSUNDEEP
keystorerhelfipsnss
Paul Schimmer
Paul Schimmer

Reputation: 313

KeyStore.setKeyEntry not working in FIPS mode

I am using RHEL 8.3 with FIPS mode on and openjdk 1.8.0.265. I am using the following token for initializing the Keystore.

name = NSSfips
nssLibraryDirectory = /usr/lib64
nssSecmodDirectory = <path to nssdb>
nssModule = fips

For keypair generation I am using: KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", "SunJSSE");

If FIPS mode is disabled at the OS level everything works fine. Once I turn on the FIPS mode using fips-mode-set --enable I get the following error

java.security.KeyStoreException: Cannot convert to PKCS11 keys
        at sun.security.pkcs11.P11KeyStore.storeSkey(P11KeyStore.java:1637)
        at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1127)
        at sun.security.pkcs11.P11KeyStore.engineSetKeyEntry(P11KeyStore.java:457)
        at java.security.KeyStore.setKeyEntry(KeyStore.java:1140)
Caused by: java.security.InvalidKeyException: Could not create key
        at sun.security.pkcs11.P11SecretKeyFactory.createKey(P11SecretKeyFactory.java:274)
        at sun.security.pkcs11.P11SecretKeyFactory.convertKey(P11SecretKeyFactory.java:179)
        at sun.security.pkcs11.P11KeyStore.storeSkey(P11KeyStore.java:1634)
        ... 46 more
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_VALUE_INVALID
        at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(Native Method)
        at sun.security.pkcs11.P11SecretKeyFactory.createKey(P11SecretKeyFactory.java:269)

I am sort of unable to comprehend the reason why setKeyEntry is failing. Is there any possible workaround or solution?

Upvotes: 1

Views: 548

Answers (0)

Related Questions