You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by bu...@apache.org on 2007/09/18 09:40:35 UTC
DO NOT REPLY [Bug 43414] New: - Cannot parse X509 cert with key size longer than 2048 (JRE 1.4)
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43414>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43414
Summary: Cannot parse X509 cert with key size longer than 2048
(JRE 1.4)
Product: Security
Version: Java 1.4.1
Platform: All
OS/Version: other
Status: NEW
Severity: blocker
Priority: P1
Component: Signature
AssignedTo: security-dev@xml.apache.org
ReportedBy: julien.pasquier@wanadoo.fr
There's a 'bug' on the CertificateFactory class of the Sun JCE Provider
integrated in the Sun Java 1.4.2, which supports cryptography for certificates
with key size no longer than 2048 bytes.
In the org.apache.xml.security.keys.content.x509.XMLX509Certificate, the
"getX509Certificate" method only use the CertificateFactory supplied by the Sun
JCE Provider of the JRE.
---------------------------
To fix this bug, developer should be specify another JCE provider (for example
BouncyCastle).
String provider = JCEMapper.getProviderId();
CertificateFactory certFact;
if (provider == null)
{
certFact = CertificateFactory.getInstance(XMLX509Certificate.JCA_CERT_ID);
}
else
{
certFact = CertificateFactory.getInstance(XMLX509Certificate.JCA_CERT_ID,
provider);
}
...
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
DO NOT REPLY [Bug 43414] - Cannot parse X509 cert with key size longer than 2048 (JRE 1.4)
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43414>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43414
julien.pasquier@wanadoo.fr changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |ASSIGNED
------- Additional Comments From julien.pasquier@wanadoo.fr 2007-09-19 07:35 -------
It works for me !
It should be implemented this solution in all java XML Security project.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
DO NOT REPLY [Bug 43414] - Cannot parse X509 cert with key size longer than 2048 (JRE 1.4)
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43414>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43414
sean.mullan@sun.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution| |WORKSFORME
------- Additional Comments From sean.mullan@sun.com 2007-09-19 08:15 -------
(In reply to comment #2)
> It works for me !
Great.
> It should be implemented this solution in all java XML Security project.
I'm not so sure about that, since I think the application knows best about which
providers it needs. Since you have a good solution now, I am closing this bug as
"works for me".
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
DO NOT REPLY [Bug 43414] - Cannot parse X509 cert with key size longer than 2048 (JRE 1.4)
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43414>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43414
sean.mullan@sun.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
------- Additional Comments From sean.mullan@sun.com 2007-09-19 06:51 -------
There are a couple of problems with the proposed solution.
First, there are plenty of other places in the code in which other JCE/JCA
engine classes are instantiated without specifying a specific provider. Second,
one provider may not be the right provider for all of them (for example, they
may not support all of the algorithms you need).
A better solution, in my opinion, is to call the standard
java.security.Security.insertProviderAt API from your application which will
insert your preferred provider(s) at the preference you would like, ex:
Security.insertProvider(new BouncyCastleProvider(), 1);
This will allow the JRE to fallback and try other installed
providers if the provider above does not support a requested algorithm or
parameters, etc.
Let me know if this works for you.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.