Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove bouncycastle dependency for EC key support #6008

Open
coopstah13 opened this issue May 14, 2024 · 2 comments
Open

remove bouncycastle dependency for EC key support #6008

coopstah13 opened this issue May 14, 2024 · 2 comments
Milestone

Comments

@coopstah13
Copy link
Contributor

Is your task related to a problem? Please describe

Newer version of BouncyCastle doesn't work with BCFIPS provider

Describe the solution you'd like

Remove dependency on BouncyCastle and rely on JDK only. The dependency is only used for EC keys, but they are supported since at least JDK8.

Describe alternatives you've considered

I have pinned the transitive bouncycastle dependency to an older version (1.68) in our repository as it seems to be the last one that doesn't have the problem.

Additional context

No response

@shawkins
Copy link
Contributor

@coopstah13 do you have suggested changes for this? The test case that was added for bcfips does not work with just the jdk - it fails with "java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : version mismatch: (supported: 00, parsed: 01 ..."

@manusa
Copy link
Member

manusa commented Jun 4, 2024

We probable need to add a specific case for
CertUtils#handleECKey so that we don't require the usage of BouncyCastle libraries for Elastic keys.

The idea would be to add some sort of fallback mechanism in

Object pemObject = new PEMParser(new InputStreamReader(keyInputStream)).readObject();

so that we attempt to use the JDK-provided classes and then use BouncyCastle if the JVM doesn't provide them.

@manusa manusa added this to the 7.0.0 milestone Jun 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants