Update an OpenJDK exclude tests list for FIPS 140-2 #116
Comments
Sanity.openjdk Failures Exclude List for FIPS TestingHard coded provider SunJCE in the test codes, or related to both SunJCE and SunRsaSign providers. Related to DES Cipher Related to ChaCha20, NoSuchAlgorithmException: Cannot find any provider supporting ChaCha20 Check all the security providers, including SunJCE, SunRsaSign, etc. Hard coded provider SunRsaSign in the test codes, NoSuchProviderException: no such provider: SunRsaSign Generate Key Pair related The following 4 failures after reduce the algorithms from Sun and SunEC, they get the existing signed jar from “/test/jdk/java/util/jar/JarFile/“ folder, and get the JarEntry, and then invoke the JarEntry.getCertificates(). The return is “null”. Hard-coded provider SunJCE in the test code, or related to both SunJCE and SunRsaSign providers. |
Extended.openjdk Failures Exclude List for FIPS TestingKeyStoreException JKS not found DSA, dsaWithSHA1 related SunJGSS and krb5 related security.provider.8=XMLDSig related Related to SunJCE or SunRsaSign, no such provider: SunJCE or no such provider: SunRsaSign CHACHA20 related java.security.NoSuchAlgorithmException: Cannot find any provider supporting Blowfish Generated DES key, java.lang.NullPointerException. Or for DES/DESede ciphers FIPS not support SunJCE provider java.security.NoSuchAlgorithmException: RSASSA-PSS KeyPairGenerator not available java.security.NoSuchAlgorithmException: LDAP CertStore not available Harded coded for provider Sun, because we remove those non-fips algorithms from Sunjava/security/KeyPairGenerator/Failover.java.Failover DSA related P11Signature Unknown mechanism Related to com.sun.exp.provider.EXP 'SHA1PRNG'java.security.NoSuchAlgorithmException: SHA1PRNG SecureRandom not available. 'Hash_DRBG'java.security.NoSuchAlgorithmException: DRBG SecureRandom not available. 'HMAC_DRBG'java.security.NoSuchAlgorithmException: DRBG SecureRandom not available. 'CTR_DRBG'java.security.NoSuchAlgorithmException: DRBG SecureRandom not available. Because we remove those from Sun JKS KeyStore not available PKCS12 Key related DSA PKCS8 related Related to curves X25519 no cipher suites in common. javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: TLS Handshake Exception Test key generation of DES and DESEDE Related to exist testing jar MessageDigest, Signature Engines are not supported in FIPS mode Related to HmacSHA3-224 CKR_ENCRYPTED_DATA_LEN_RANGE issue due to a not multiple of AES block size. From the latest PKCS11 Cryptographic Token Interface Base Specification Version 3.0. Execution failed: `main' threw exception: java.lang.ClassCastException: sun.security.pkcs11.P11Key$P11PrivateKey incompatible with java.security.interfaces.ECPrivateKey |
WilburZjh
changed the title
Currently, only 4 restrictive security providers can be used when FIPS mode is enabled. So there may be some tests failed due to the limitations of the specific types of providers. This issue aims to update the OpenJDK exclude tests list “ProblemList-fips.txt” for the FIPS testing.
The text was updated successfully, but these errors were encountered: