BouncyCastle jars giving SHA1 Digest Error for JDK 1.7

bouncycastlejava-7signweblogic

For my project, I have to digitally sign a string and I am using bouncycastle jars for the same. The environment Details are as follows.

Weblogic 12c JSF, Primefaces Java Version : 1.7.0_45 BC Jars :
bcmail-jdk15on-152.jar, bcpkix-jdk15on-152.jar,
bcprov-ext-jdk15on-152.jar, bcprov-jdk15on-152.jar

Alternatively I have used bcprov-jdk16-1.45.jar and bcmail-jdk16-1.45.jar as well but the result is same. The Error I am getting is,

java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: SHA1WithRSAEncryption, provider: BC, class: org.bouncycastle.jce.provider.JDKDigestSignature$SHA1WithRSAEncryption)
    at java.security.Provider$Service.newInstance(Provider.java:1262) ~[?:1.7.0_45]
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:236) ~[?:1.7.0_45]
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:206) ~[?:1.7.0_45]
    at java.security.Signature.getInstance(Signature.java:355) ~[?:1.7.0_45]
    at DigiSigner.sign(DigiSigner.java:185) [DigiSigner.class:?]
    ... 40 more
Caused by: java.lang.SecurityException: SHA1 digest error for org/bouncycastle/jce/provider/JDKDigestSignature$SHA1WithRSAEncryption.class
    at sun.security.util.ManifestEntryVerifier.verify(ManifestEntryVerifier.java:220) ~[?:1.7.0_45]
    at java.util.jar.JarVerifier.processEntry(JarVerifier.java:229) ~[?:1.7.0_45]
    at java.util.jar.JarVerifier.update(JarVerifier.java:216) ~[?:1.7.0_45]
    at java.util.jar.JarVerifier$VerifierStream.read(JarVerifier.java:471) ~[?:1.7.0_45]
    at sun.misc.Resource.getBytes(Resource.java:124) ~[?:1.7.0_45]
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:444) ~[?:1.7.0_45]
    at java.net.URLClassLoader.access$100(URLClassLoader.java:71) ~[?:1.7.0_45]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:361) ~[?:1.7.0_45]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:355) ~[?:1.7.0_45]
    at java.security.AccessController.doPrivileged(Native Method) ~[?:1.7.0_45]
    at java.net.URLClassLoader.findClass(URLClassLoader.java:354) ~[?:1.7.0_45]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[?:1.7.0_45]
    at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) ~[?:1.7.0_45]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[?:1.7.0_45]
    at java.security.Provider$Service.getImplClass(Provider.java:1279) ~[?:1.7.0_45]
    at java.security.Provider$Service.newInstance(Provider.java:1237) ~[?:1.7.0_45]
    ... 44 more

The Code for DigiSigner.java is

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.InvalidKeyException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.Security;
import java.security.Signature;
import java.security.SignatureException;
import java.security.UnrecoverableKeyException;
import java.security.cert.Certificate;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.List;

import org.bouncycastle.cert.jcajce.JcaCertStore;
import org.bouncycastle.cms.CMSException;
import org.bouncycastle.cms.CMSProcessableByteArray;
import org.bouncycastle.cms.CMSSignedData;
import org.bouncycastle.cms.CMSSignedDataGenerator;
import org.bouncycastle.cms.CMSTypedData;
import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
import org.bouncycastle.util.Store;

import sun.misc.BASE64Encoder;


@SuppressWarnings("rawtypes")
public class DigiSigner {
    private String certFilePath = null;
    private String pfxFilename = null;
    private String jksFilename = null;
    private String certPassword = null;
    private char[] certPasswordArr = null;
    private KeyStore keystore = null;
    CMSSignedDataGenerator sgen = null;


    @SuppressWarnings("unchecked")
    public DigiSigner(String certificatePrefix) throws IBException{
        ConfigManager config = ConfigManager.getConfigManager();
        this.certFilePath = "D:/Chintan/cert_files";
        this.pfxFilename = "chintan.pfx";
        this.jksFilename = "chintan.jks";
        this.certPassword = "abc123";

        certPasswordArr = certPassword.toCharArray();

        try{
            this.keystore = KeyStore.getInstance("jks");
            File jksFile = new File(certFilePath + "/" + jksFilename);
            if(!jksFile.exists()){
                this.createJKS();
            }
            InputStream input = new FileInputStream(certFilePath + "/" + jksFilename);
            keystore.load(input, certPasswordArr);

        }
        catch(KeyStoreException e){
            e.printStacktrace();
        } 
        catch (NoSuchAlgorithmException e) {
            e.printStacktrace();
        } 
        catch (CertificateException e) {
            e.printStacktrace();
        } 
        catch (IOException e) {
            e.printStacktrace();
        }
    }

    @SuppressWarnings("unchecked")
    public String sign(String dataToSign) throws IBException{
        String signedData = null;
        try {
            byte[] dataToSignArr = dataToSign.getBytes();
            Security.addProvider(new BouncyCastleProvider());
            Enumeration e = keystore.aliases();
            String alias = "";
            if(e != null){
                while(e.hasMoreElements()){
                    String  n = (String)e.nextElement();
                    if (keystore.isKeyEntry(n)){
                        alias = n;
                    }
                }
            }
            PrivateKey privateKey = (PrivateKey) keystore.getKey(alias, certPasswordArr);
            Signature signature = Signature.getInstance("SHA1WithRSA", "BC");
            signature.initSign(privateKey);
            signature.update(dataToSignArr);

            //Build CMS
            X509Certificate cert = (X509Certificate) this.keystore.getCertificate(alias);
            List certList = new ArrayList();
            CMSTypedData msg = new CMSProcessableByteArray(signature.sign());
            certList.add(cert);
            Store certs = new JcaCertStore(certList);
            CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
            ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(privateKey);
            gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()).build(sha1Signer, cert));
            gen.addCertificates(certs);
            CMSSignedData sigData = gen.generate(msg, false);
            BASE64Encoder encoder = new BASE64Encoder();
            signedData = encoder.encode((byte[]) sigData.getSignedContent().getContent());
            System.out.println("Signature is : " + signedData);     
        }
        catch(KeyStoreException e){
            e.printStacktrace();
        } 
        catch (NoSuchAlgorithmException e) {
            e.printStacktrace();
        }
        catch (NoSuchProviderException e) {
            e.printStacktrace();
        }
        catch (CMSException e) {
            e.printStacktrace();
        }
        catch (UnrecoverableKeyException e) {
            e.printStacktrace();
        } 
        catch (SignatureException e) {
            e.printStacktrace();
        }
        catch (InvalidKeyException e) {
            e.printStacktrace();
        }
        catch (CertificateEncodingException e) {
            e.printStacktrace();
        }
        catch (OperatorCreationException e) {
            e.printStacktrace();
        } 
        return signedData;
    }

    public void createJKS() throws IBException{
        try{
            File fileIn = new File(certFilePath + "/" + pfxFilename);
            File fileOut = new File(certFilePath + "/" + jksFilename);

            if(!fileIn.canRead()){
                throw new IBException("Unable to access input keystore: " + fileIn.getPath());
            }
            if(fileOut.exists() && !fileOut.canWrite()){
                throw new IBException("Output file is not writable: " + fileOut.getPath());
            }

            KeyStore kspkcs12 = KeyStore.getInstance("PKCS12");
            KeyStore ksjks = KeyStore.getInstance("jks");

            char inphrase[] = certPassword.toCharArray();
            char outphrase[] = certPassword.toCharArray();


            kspkcs12.load(new FileInputStream(fileIn), inphrase);
            ksjks.load(fileOut.exists() ? ((java.io.InputStream) (new FileInputStream(fileOut))) : null, outphrase);
            Enumeration eAliases = kspkcs12.aliases();
            do{
                if(!eAliases.hasMoreElements())
                    break;
                String strAlias = (String)eAliases.nextElement();
                if(kspkcs12.isKeyEntry(strAlias))
                {
                    java.security.Key key = kspkcs12.getKey(strAlias, inphrase);
                    Certificate chain[] = kspkcs12.getCertificateChain(strAlias);
                    ksjks.setKeyEntry(strAlias, key, outphrase, chain);
                }
            } 
            while(true);
            OutputStream out = new FileOutputStream(fileOut);
            ksjks.store(out, outphrase);
            out.close();
        }
        catch(KeyStoreException e){
            e.printStacktrace();
        }
        catch (NoSuchAlgorithmException e) {
            e.printStacktrace();
        } 
        catch (CertificateException e) {
            e.printStacktrace();
        }
        catch (FileNotFoundException e) {
            e.printStacktrace();
        }
        catch (IOException e) {
            e.printStacktrace();
        }
        catch (UnrecoverableKeyException e) {
            e.printStacktrace();
        } 
        System.out.println("Java Key Store created successfully");
    }
}

I Referred this link : Bouncycastle for JDK 1.7 and PKCS libraries – But well, it's not working for me.

The error is on this line : Signature signature = Signature.getInstance("SHA1WithRSA", "BC");

Best Answer

As mentioned here, Weblogic contains an invalid bcprov-jdk16-1.45.jar

Try to verify MW_HOME/oracle_common/modules/bcprov-jdk16-1.45.jar with jarsigner utility:

jarsigner -verify bcprov-jdk16-1.45.jar

The SecurityException is thrown:

jarsigner: java.lang.SecurityException: SHA1 digest error for org/bouncycastle/jce/ECKeyUtil$UnexpectedException.class

The file differs from the one in the Maven Repository, that passes verification successfully.

Related Solutions

Java – New features in JDK 1.6 and 1.7

JDK 1.6 Compatibility http://www.oracle.com/technetwork/java/javase/compatibility-137541.html

Core Java Technology Features http://www.oracle.com/technetwork/articles/java/javase6-build39-139826.html http://java.sun.com/developer/technicalArticles/J2SE/Desktop/JavaSE6_build39.html

Java SE 6 Performance White Paper http://www.oracle.com/technetwork/java/6-performance-137236.html

Quick note, implementation of the java.util.ArrayList was changed (due to bug 6260652).

JDK 1.7

Java SE 7 and JDK 7 Compatibility http://www.oracle.com/technetwork/java/javase/compatibility-417013.html (there are some behavioral incompatibilities).

Java SE 7 Features and Enhancements http://www.oracle.com/technetwork/java/javase/jdk7-relnotes-418459.html

A look at Java 7's new features http://radar.oreilly.com/2011/09/java7-features.html (see also http://docs.oracle.com/javase/7/docs/technotes/guides/language/type-inference-generic-instance-creation.html for diamond operator)

(Misc) JDK 7: New Interfaces, Classes, Enums, and Methods http://marxsoftware.blogspot.com/2011/03/jdk-7-new-interfaces-classes-enums-and.html

Java – JDK 1.7 Throwable `addSuppressed()` method

In general, Throwable addSuppressed() method should be used when in some way we have parallel execution which can produce exception, that where suppressed. I found 2 examples;

Try-with-resource block (try-finally block) when the calling code would see the original exception (in the try or catch block) and the exception that happened in the finally block.
batch jobs (bulk operations) when we should proceed to the next item regardless whether the operation on the current item succeeded or not

Before getting to the details, as @sarelbotha stated, in my case I just have to keep wrapping the original exception as the cause of my new exception.

Default behaviour in try-finally block, where we have 2 exceptions, that the original exception is suppressed and we see only exception from finally block. If we use finally block on order to close the resource than we really want to see the original exception, but optionally we want to see also exceptions from the finally block, that closed our resource and fails.

As of release 7, the platform supports the notion of suppressed exceptions (in conjunction with the try-with-resources statement). Any exceptions that were suppressed in order to deliver an exception are printed out beneath the stack trace.

http://docs.oracle.com/javase/7/docs/api/java/lang/Throwable.html#printStackTrace%28%29

First one should read about try-with-resource new feature. You can read it here http://www.baptiste-wicht.com/2010/08/java-7-try-with-resources-statement/ for example or here What is the Java 7 try-with-resources bytecode equivalent using try-catch-finally?. In short, you can have 2 Throwable in parallel in some sense, typically from you try block and from your finally block. An old try-catch semantic will return exception from the finally block whule suppressed exception from the try block (or rethrowing exception from the catch block). A new try-with-resource feature enables you to get both exception. Even more, you will receive original exception where exception from the finally block will be suppressed

Note that when one exception causes another exception, the first exception is usually caught and then the second exception is thrown in response. In other words, there is a causal connection between the two exceptions. In contrast, there are situations where two independent exceptions can be thrown in sibling code blocks, in particular in the try block of a try-with-resources statement and the compiler-generated finally block which closes the resource. In these situations, only one of the thrown exceptions can be propagated. In the try-with-resources statement, when there are two such exceptions, the exception originating from the try block is propagated and the exception from the finally block is added to the list of exceptions suppressed by the exception from the try block. As an exception unwinds the stack, it can accumulate multiple suppressed exceptions.

Example:

    public class TestClass {
static class ResourceA implements AutoCloseable{
      public void read() throws Exception{
        throw new Exception("ResourceA read exception");
      }
      @Override
      public void close() throws Exception {
        throw new Exception("ResourceA close exception");
      }
    };

static class ResourceB implements AutoCloseable{
      public void read() throws Exception{
        throw new Exception("ResourceB read exception");
      }
      @Override
      public void close() throws Exception {
        throw new Exception("ResourceB close exception");
      }
    };

    //a test method
    public static void test() throws Exception{
      try (ResourceA a = new ResourceA();
           //ResourceB b = new ResourceB()
              ) {
        a.read();
        //b.read();
      } catch (Exception e) {
        throw e;
      }
    }

    public static void main(String[] args)  throws Exception {
        test();
    }

}

Output will be the following:

Exception in thread "main" java.lang.Exception: ResourceA read exception
at TestClass$ResourceA.read(TestClass.java:6)
at TestClass.test(TestClass.java:29)
at TestClass.main(TestClass.java:39)
Suppressed: java.lang.Exception: ResourceA close exception
    at TestClass$ResourceA.close(TestClass.java:10)
    at TestClass.test(TestClass.java:31)
    ... 1 more

batch jobs (bulk operations). Well, I found some usage of this method outside try-with-resources. Below, is source code from the java.net.URLClassLoader.close

 public void close() throws IOException {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(new RuntimePermission("closeClassLoader"));
    }
    List<IOException> errors = ucp.closeLoaders();
    // now close any remaining streams.
    synchronized (closeables) {
        Set<Closeable> keys = closeables.keySet();
        for (Closeable c : keys) {
            try {
                c.close();
            } catch (IOException ioex) {
                errors.add(ioex);
            }
        }
        closeables.clear();
    }
    if (errors.isEmpty()) {
        return;
    }
    IOException firstex = errors.remove(0);
    // Suppress any remaining exceptions
    for (IOException error: errors) {
        **firstex.addSuppressed(error);**
    }
    throw firstex;
}

In general, such approach can be used in batch jobs (bulk operations), when we should proceed to the next item (closing next open streams as is in this example) regardless whether the operation on the current item succeeded or not. In such a way, we have as I stated before, in some way parallel execution which can produce exception, that where suppressed. In such cases we should use the approach above to throw on exception with remaining suppressed exception in it.

Best Answer

Related Solutions

Java – New features in JDK 1.6 and 1.7

Java – JDK 1.7 Throwable `addSuppressed()` method

Related Topic