SFTP Transfer Failure

[Malavika1511]

We are using Maverick for SFTP file transfers and Bouncy Castle as the provider. During the file transfers, Maverick reads and writes the known_hosts key. We have observed that the known_hosts file intermittently gets corrupted and recreated. However, the file transfer suddenly stops. From the thread dump, the FTP/SFTP connection thread appears to be running. We found a related issue here: https://github.com/bcgit/bc-java/issues/1599. We would like your input on whether the thread stack trace below could be the cause of the permanent SFTP failure, even though the Java process keeps restarting.

"FTP/SFTP Connection Creation Thread-Thread-1" #426518 prio=10 os_prio=0 tid=0x00007fe7dc28a800 nid=0x1b8919 runnable [0x00007fe0830ca000]
java.lang.Thread.State: RUNNABLE
at org.bouncycastle.math.ec.rfc8032.Scalar25519.reduceBasisVar(Unknown Source)
at org.bouncycastle.math.ec.rfc8032.Ed25519.implVerify(Unknown Source)
at org.bouncycastle.math.ec.rfc8032.Ed25519.verify(Unknown Source)
at org.bouncycastle.crypto.params.Ed25519PublicKeyParameters.verify(Unknown Source)
at org.bouncycastle.crypto.signers.Ed25519Signer$Buffer.verifySignature(Unknown Source)
- locked <0x0000000316000f60> (a org.bouncycastle.crypto.signers.Ed25519Signer$Buffer)
at org.bouncycastle.crypto.signers.Ed25519Signer.verifySignature(Unknown Source)
at org.bouncycastle.jcajce.provider.asymmetric.edec.SignatureSpi.engineVerify(Unknown Source)
at java.security.Signature$Delegate.engineVerify(Signature.java:1393)
at java.security.Signature.verify(Signature.java:770)
at com.maverick.ssh.components.jce.SshEd25519PublicKeyJCE.verifyJCESignature(SshEd25519PublicKeyJCE.java:176)
at com.maverick.ssh.components.jce.SshEd25519PublicKeyJCE.verifySignature(SshEd25519PublicKeyJCE.java:164)
at com.maverick.ssh2.TransportProtocol.performKeyExchange(TransportProtocol.java:2094)
- locked <0x0000000316000f78> (a java.util.ArrayList)
at com.maverick.ssh2.TransportProtocol.processMessage(TransportProtocol.java:2739)
at com.maverick.ssh2.TransportProtocol.startTransportProtocol(TransportProtocol.java:503)
at com.maverick.ssh2.Ssh2Client.connect(Ssh2Client.java:209)
at com.maverick.ssh.SshConnector.connect(SshConnector.java:733)
at com.maverick.ssh.SshConnector.connect(SshConnector.java:535)
at cmg.stdapp.distributor.SFtpConnect.connectSFTPKeyPassword(Unknown Source)
at cmg.stdapp.distributor.FTPObject.connectFTPSFTP(Unknown Source)
at cmg.stdapp.distributor.worker.FTPWorker.ftpSftpConnection(Unknown Source)
at cmg.stdapp.distributor.worker.FTPWorker.createFtpSftpConn(Unknown Source)
at cmg.stdapp.distributor.worker.InitializeFtpSftpConnectionTask.call(Unknown Source)
at cmg.stdapp.distributor.worker.InitializeFtpSftpConnectionTask.call(Unknown Source)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:750)

[peterdettman]

The stack trace is consistent with #1599 . In that issue, the verification always falls into an infinite loop for a small (but deterministic) proportion of [public key, signature, message] combinations.

Upgrading to the latest (or at least 1.78) fixes the underlying issue and also limits the number of iterations in any case.

I don't know how this would relate to known_hosts changes or the restarts (some sort of hanged-process detection?).

[Malavika1511]

Yes, the process hanged in the runnable state. So, will upgrading to 1.78 solve the problem?

[peterdettman]

It will solve the Ed25519 infinite loop issue at least.

[Malavika1511]

In our organisation for all 3PP, we need to build from the source code.
To build, we downloaded and extracted the source code https://repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk18on/1.81/bcprov-jdk18on-1.81-sources.jar
and copy pasted the pom https://repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk18on/1.81/bcprov-jdk18on-1.81.pom in pom.xml. empty jar created without class files.
Please share us the correct pom (or) the steps to be followed for building the jar

[peterdettman]

The jar is not buildable form the -sources jar, but in any case that is a completely separate question/issue. I suggest you actually look for information about building BouncyCastle, and then open a new discussion or issue if you run into problems.