JDK11.0.10 not working with BouncyCastle-168 ........java.lang.ClassCastException: class org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey

[wei-kumar]

I am using JDK11.0.10, my BC-168 still hit this same issue.
Apparently, this issue was report in this thread : #589
I noticed that the case was closed on Oct 30, 2020.
BC-168 made available on 12/21/2020. I would expect the fix should in this BC-168 but apparently it is not.
I know the workaround is given in that thread but would like to sort out for permanent fix in BC.

call stack :
java.lang.ClassCastException: class org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey cannot be cast to class java.security.interfaces.XECPublicKey (org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey is in unnamed module of loader weblogic.utils.classloaders.GenericClassLoader @4bb927a8; java.security.interfaces.XECPublicKey is in module java.base of loader 'bootstrap')
at java.base/sun.security.ssl.XDHKeyExchange$XDHEPossession.(XDHKeyExchange.java:108)
at java.base/sun.security.ssl.NamedGroup$XDHFunctions.createPossession(NamedGroup.java:765)
at java.base/sun.security.ssl.NamedGroup.createPossession(NamedGroup.java:405)
at java.base/sun.security.ssl.SSLKeyExchange$T13KeyAgreement.createPossession(SSLKeyExchange.java:568)

Please look into this issue.

[dghgit]

I don't think this is quite the same thing. If you are using the multi-release version of 1.68 Java 11 will use BC11XDHPublicKey - the above seems to be using the 1.8 class, which rely implies serialization or an earlier release of BC in the class path. Can you verify how the key is created.

[wei-kumar]

Thank you for your quick response and good point you have mentioned.
The BC-168 I am using : bcprov-jdk15on-168.jar
This error comes when startup Weblogic 14 with Java 11.0.10 CPU :
weblogic.security.SSL.jsseadapter: SSLENGINE:
Exception occurred during SSLEngine.unwrap(ByteBuffer,ByteBuffer[]).
java.lang.ClassCastException: class org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey cannot be
cast to class java.security.interfaces.XECPublicKey (org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey is in
unnamed module of loader weblogic.utils.classloaders.GenericClassLoader@4bb927a8; java.security.interfaces.XECPublicKey is in module java.base of loader 'bootstrap')
will certainly verify the class path loading on BC...

[dghgit]

One further thing. This has got me wondering. The bcprov jar, how is it being loaded and by whom? The stack trace makes it look like it's the weblogic class loader loading it. I don't even know if that will recognise a multi-release jar. Have you tried getting the system class loader to load the bcprov jar instead?

[wei-kumar]

We have explicitly making Weblogic to load our BC-168 first during startup.

using –verbose:class to find from where the BCXDHPublicKey is getting loaded and it getting loaded from the jar that we are packaged in environment.

[1263.091s][info][class,load ] org.bouncycastle.jcajce.provider.asymmetric.edec.BCXDHPublicKey source: file:/opt/MMM/XXX/MMM/cfghome/webserv/UUUUU/applications/YYYYYY/lib/bcprov-jdk15on-168.jar

Also to double confirm, in another environment ---- just removed all the bcprov-jdk15on.jar files available within WebLogic (/opt/MMMM/XXX/YYY/bea/) and there also the same issue happened. So we can rollout the use of BC available within WebLogic.

Also I couldn’t find any reference to BC11XDHPublicKey(mentioned here) in logs.
So I think we can confirm that issue is happening in latest bcprov-jdk15on-168.jar

[dghgit]

You'll find BC11XDHPublicKey in META-INF/versions/11 - try getting the system class loader, not weblogic to load the BC provider jar. I don't think weblogic can handle the jar properly.

[wei-kumar]

we did confirm bcprov-jdk15on-168.jar is loaded in weblogic properly. Any solution to move forward ? Current workaround is to put system property jdk.tls.namedGroups to by pass this issue.

[dghgit]

Try the current beta at https://www.bouncycastle.org/betas I'm not sure if it will work, but the integration with Java 15 and Java 11 is improved in that. If it doesn't work unfortunately it will confirm that weblogic is not loading the jar correctly as the multi-release class files are being ignored. If that's the case the only other solution would be to build on non-multi release jar for the JVM specifically.

[dapete42]

I ran into the same issue after updating to OpenJDK 11.0.10. As suggested I replaced the JARs by the current beta versions (bcprov-jdk15on-169b05.jar and bcpkix-jdk15on-169b05.jar). That solved the problem for me.

[dghgit]

Fixed in 1.69

[ashutosh-pathak-alight]

Fixed in 1.69

added the same version but getting the same error