8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 #9072

zzambers · 2022-06-07T22:07:17Z

TLS *_CHACHA20_POLY1305_* cipher suites are currently broken when configuration with SunPKCS11 provider is used. I discovered this by my ssl-tests testsuite [1].

make TEST_PKCS11_FIPS=1 SSLTESTS_SSL_CONFIG_FILTER=SunJSSE,Default,TLSv1.2,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 SSLTESTS_CUSTOM_JAVA_PARAMS=-Djdk.tls.ephemeralDHKeySize=2048 ssl-tests
...
javax.net.ssl.SSLException: Unknown algorithm: ChaCha20-Poly1305
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:132)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
	at java.base/sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1712)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:470)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
	at SSLSocketClient.test(SSLSocketClient.java:72)
	at SSLSocketTester.testConfiguration(SSLSocketTester.java:392)
	at SSLSocketTester.testConfigurations(SSLSocketTester.java:322)
	at SSLSocketTester.testProvider(SSLSocketTester.java:234)
	at SSLSocketTester.testProviders(SSLSocketTester.java:190)
	at Main.main(Main.java:30)
Caused by: java.security.ProviderException: Unknown algorithm: ChaCha20-Poly1305
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11TlsKeyMaterialGenerator.engineGenerateKey(P11TlsKeyMaterialGenerator.java:168)
	at java.base/javax.crypto.KeyGenerator.generateKey(KeyGenerator.java:564)
	at java.base/sun.security.ssl.SSLTrafficKeyDerivation$LegacyTrafficKeyDerivation.<init>(SSLTrafficKeyDerivation.java:282)
	at java.base/sun.security.ssl.SSLTrafficKeyDerivation$T12TrafficKeyDerivationGenerator.createKeyDerivation(SSLTrafficKeyDerivation.java:117)
	at java.base/sun.security.ssl.SSLTrafficKeyDerivation.createKeyDerivation(SSLTrafficKeyDerivation.java:79)
	at java.base/sun.security.ssl.DHClientKeyExchange$DHClientKeyExchangeProducer.produce(DHClientKeyExchange.java:221)
	at java.base/sun.security.ssl.ClientKeyExchange$ClientKeyExchangeProducer.produce(ClientKeyExchange.java:65)
	at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:440)
	at java.base/sun.security.ssl.ServerHelloDone$ServerHelloDoneConsumer.consume(ServerHelloDone.java:182)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
	... 7 more

FAILED: SunJSSE/Default: TLSv1.2 + TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256

Problem:
Exception is thrown by P11TlsKeyMaterialGenerator.engineGenerateKey method [2], based on result of P11SecretKeyFactory.getKeyType method [3], which only "knows" "ChaCha20" key algorithm, but does not accept "ChaCha20-Poly1305" as algorithm. Algorithm value is passed from SSLTrafficKeyDerivation.LegacyTrafficKeyDerivation class [4], which leads to algorithm field in SSLCipher class [5]. Value of that field comes from cipher name in JsseJce class [6] (ending at first slash, if any).

Fix:
This fix basically modifies P11SecretKeyFactory.getKeyType method to accept "ChaCha20-Poly1305" as alias for "ChaCha20".

Testing:
I ran jdk_security tests locally and they passed. Also failure in ssl-tests gets fixed.

[1] https://github.com/zzambers/ssl-tests
[2]

jdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11TlsKeyMaterialGenerator.java

Line 168 in b7a34f7

("Unknown algorithm: " + spec.getCipherAlgorithm());

[3]

jdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java

Line 101 in b7a34f7

static long getKeyType(String algorithm) {

[4]

jdk/src/java.base/share/classes/sun/security/ssl/SSLTrafficKeyDerivation.java

Line 270 in b7a34f7

TlsKeyMaterialParameterSpec spec = new TlsKeyMaterialParameterSpec(

[5]

jdk/src/java.base/share/classes/sun/security/ssl/SSLCipher.java

Line 496 in b7a34f7

this.algorithm = splits[0];

[6]

jdk/src/java.base/share/classes/sun/security/ssl/JsseJce.java

Line 81 in b7a34f7

static final String CIPHER_CHACHA20_POLY1305 = "ChaCha20-Poly1305";

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305

Reviewers

Valerie Peng (@valeriepeng - Reviewer) ⚠️ Review applies to b9c070c3

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk pull/9072/head:pull/9072
$ git checkout pull/9072

Update a local copy of the PR:
$ git checkout pull/9072
$ git pull https://git.openjdk.org/jdk pull/9072/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 9072

View PR using the GUI difftool:
$ git pr show -t 9072

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/9072.diff

bridgekeeper · 2022-06-07T22:07:58Z

👋 Welcome back zzambers! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2022-06-07T22:10:19Z

@zzambers The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2022-06-22T15:50:15Z

Webrevs

valeriepeng · 2022-06-23T16:38:20Z

The title generally state the problem, or action/expectation. How about either "P11TlsKeyMaterialGenerator does not work with ChaCha20-Poly1305" or "P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305"?

valeriepeng · 2022-06-23T16:47:18Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java

+        if ("ChaCha20-Poly1305".equals(algorithm)) {
+            algorithm = "ChaCha20";
+        }


Have you considered adding "ChaCha20-Poly1305" into the "keyTypes" instead? Then you don't need to add the if-block here.

That would indeed be cleaner solution. I'll make this change. Thank you.

Please update the 2nd copyright year to 2022 also.

zzambers · 2022-06-23T22:14:55Z

I have addressed both remarks.
jdk_security tests passed for me locally with this change.
Thanks

valeriepeng · 2022-06-23T22:48:53Z

test/jdk/sun/security/pkcs11/tls/TestKeyMaterialChaCha20.java

+ * @test
+ * @bug 8288985
+ * @summary Test that KeyMaterial generator works with ChaCha20-Poly1305
+ * @author Zdenek Zambersky


nit: IIRC we no longer add @author tag.

valeriepeng · 2022-06-23T22:49:15Z

test/jdk/sun/security/pkcs11/tls/TestKeyMaterialChaCha20.java

+/*
+ * @test
+ * @bug 8288985
+ * @summary Test that KeyMaterial generator works with ChaCha20-Poly1305


nit: add "TLS"

valeriepeng · 2022-06-23T22:57:12Z

test/jdk/sun/security/pkcs11/tls/TestKeyMaterialChaCha20.java

+        try {
+            KeyGenerator.getInstance("ChaCha20", provider);
+        } catch (NoSuchAlgorithmException e) {
+            System.out.println("Skipping, ChaCha20 not supported");
+            return;
+        }


This test does not use CKM_CHACHA20_KEY_GEN, and the test passes when I run it against the version of NSS which does not support CKM_CHACHA20_KEY_GEN. Since the test requires the provider to support "SunTlsRsaPremasterSecret", "SunTls12MasterSecret", and "SunTls12KeyMaterial" key generators, probably should base the check on them instead?

valeriepeng · 2022-06-23T22:58:41Z

test/jdk/sun/security/pkcs11/tls/TestKeyMaterialChaCha20.java

+        // https://github.com/openjdk/jdk/blob/ccec5d1e8529c8211cc678d8acc8d37fe461cb51/src/java.base/share/classes/sun/security/ssl/SSLTrafficKeyDerivation.java#L270
+        // https://github.com/openjdk/jdk/blob/ccec5d1e8529c8211cc678d8acc8d37fe461cb51/src/java.base/share/classes/sun/security/ssl/CipherSuite.java#L93


nit: do these two links really needed? If yes, add some more text for their purpose?

valeriepeng · 2022-06-23T23:01:36Z

I have addressed both remarks. jdk_security tests passed for me locally with this change. Thanks

I will submit a test job on my end also, just to be safe.

zzambers · 2022-06-27T13:18:11Z

I have made fixes to the test based on your comments. I retested test :) and works ( fails without fix in P11SecretKeyFactory.java passes with ).
Thanks

valeriepeng

Looks good. Thanks!

openjdk · 2022-06-27T21:55:46Z

@zzambers This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305

Reviewed-by: valeriep

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 378 new commits pushed to the master branch:

b96ba19: 8289182: NMT: MemTracker::baseline should return void
779b4e1: 8287001: Add warning message when fail to load hsdis libraries
910053b: 8280235: Deprecated flag FlightRecorder missing from VMDeprecatedOptions test
7b3bf97: 8289401: Add dump output to TestRawRSACipher.java
86dc760: Merge
1504804: 8289398: ProblemList jdk/jfr/api/consumer/recordingstream/TestOnEvent.java on linux-x64 again
9b7805e: 8289069: Very slow C1 arraycopy jcstress tests after JDK-8279886
c42b796: 8288058: Broken links on constant-values page
a814293: 8275784: Bogus warning generated for record with compact constructor
6f9717b: 8288836: (fs) Files.writeString spec for IOException has "specified charset" when no charset is provided
... and 368 more: https://git.openjdk.org/jdk/compare/c78392db4dd7c31db9eea608a335f6d9239c6a55...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@valeriepeng) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

zzambers · 2022-06-28T15:33:24Z

I have realized, I forgot to fix copyright date in P11SecretKeyFactory.java, so fixed that.

zzambers · 2022-06-28T15:34:38Z

@valeriepeng Thank you for the review

valeriepeng · 2022-06-29T00:36:34Z

@valeriepeng Thank you for the review

Once you did the "/integrate" command, I can then sponsor this change.

zzambers · 2022-06-29T10:07:44Z

/integrate

openjdk · 2022-06-29T10:08:49Z

@zzambers
Your change (at version 804b2f0) is now ready to be sponsored by a Committer.

valeriepeng · 2022-06-29T17:19:11Z

/sponsor

openjdk · 2022-06-29T17:20:15Z

Going to push as commit b6bd190.
Since your change was applied there have been 383 commits pushed to the master branch:

ba670ec: 8289094: [JVMCI] reduce JNI overhead and other VM rounds trips in JVMCI
0709a6a: 8284942: Proxy building can just iterate superinterfaces once
2961b7e: 8285364: Remove REF_ enum for java.lang.ref.Reference
167ce4d: 8289421: No-PCH build for Minimal VM was broken by JDK-8287001
108cd69: 8283726: x86_64 intrinsics for compareUnsigned method in Integer and Long
b96ba19: 8289182: NMT: MemTracker::baseline should return void
779b4e1: 8287001: Add warning message when fail to load hsdis libraries
910053b: 8280235: Deprecated flag FlightRecorder missing from VMDeprecatedOptions test
7b3bf97: 8289401: Add dump output to TestRawRSACipher.java
86dc760: Merge
... and 373 more: https://git.openjdk.org/jdk/compare/c78392db4dd7c31db9eea608a335f6d9239c6a55...master

Your commit was automatically rebased without conflicts.

openjdk · 2022-06-29T17:20:35Z

@valeriepeng @zzambers Pushed as commit b6bd190.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Key material generator works with ChaCha20-Poly1305

8fdd7b9

openjdk bot added the security security-dev@openjdk.org label Jun 7, 2022

zzambers changed the title ~~P11TlsKeyMaterialGenerator works with ChaCha20-Poly1305~~ 8288985: P11TlsKeyMaterialGenerator works with ChaCha20-Poly1305 Jun 22, 2022

openjdk bot added the rfr Pull request is ready for review label Jun 22, 2022

TestKeyMaterialChaCha20.java: Added bug number

514da32

valeriepeng reviewed Jun 23, 2022

View reviewed changes

zzambers added 2 commits June 23, 2022 19:26

ChaCha20-Poly1305 added as key type

77d7500

Link in comment made pernament

7277ebe

zzambers changed the title ~~8288985: P11TlsKeyMaterialGenerator works with ChaCha20-Poly1305~~ 8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 Jun 23, 2022

valeriepeng reviewed Jun 23, 2022

View reviewed changes

TestKeyMaterialChaCha20.java: fixes

b9c070c

valeriepeng approved these changes Jun 27, 2022

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Jun 27, 2022

Updated copyright date in P11SecretKeyFactory.java

804b2f0

openjdk bot added the sponsor Pull request is ready to be sponsored label Jun 29, 2022

openjdk bot added the integrated Pull request has been integrated label Jun 29, 2022

openjdk bot closed this Jun 29, 2022

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels Jun 29, 2022

8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 #9072

8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 #9072

zzambers commented Jun 7, 2022 •

edited by openjdk bot

bridgekeeper bot commented Jun 7, 2022

openjdk bot commented Jun 7, 2022

mlbridge bot commented Jun 22, 2022 •

edited

valeriepeng commented Jun 23, 2022

valeriepeng Jun 23, 2022

zzambers Jun 23, 2022

valeriepeng Jun 23, 2022

zzambers commented Jun 23, 2022

valeriepeng Jun 23, 2022

valeriepeng Jun 23, 2022

valeriepeng Jun 23, 2022

valeriepeng Jun 23, 2022

valeriepeng commented Jun 23, 2022

zzambers commented Jun 27, 2022

valeriepeng left a comment

openjdk bot commented Jun 27, 2022 •

edited

zzambers commented Jun 28, 2022 •

edited

zzambers commented Jun 28, 2022

valeriepeng commented Jun 29, 2022

zzambers commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

valeriepeng commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

		// https://github.com/openjdk/jdk/blob/ccec5d1e8529c8211cc678d8acc8d37fe461cb51/src/java.base/share/classes/sun/security/ssl/SSLTrafficKeyDerivation.java#L270
		// https://github.com/openjdk/jdk/blob/ccec5d1e8529c8211cc678d8acc8d37fe461cb51/src/java.base/share/classes/sun/security/ssl/CipherSuite.java#L93

8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 #9072

8288985: P11TlsKeyMaterialGenerator should work with ChaCha20-Poly1305 #9072

Conversation

zzambers commented Jun 7, 2022 • edited by openjdk bot

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Jun 7, 2022

openjdk bot commented Jun 7, 2022

mlbridge bot commented Jun 22, 2022 • edited

Webrevs

valeriepeng commented Jun 23, 2022

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

zzambers Jun 23, 2022

Choose a reason for hiding this comment

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

zzambers commented Jun 23, 2022

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

valeriepeng Jun 23, 2022

Choose a reason for hiding this comment

valeriepeng commented Jun 23, 2022

zzambers commented Jun 27, 2022

valeriepeng left a comment

Choose a reason for hiding this comment

openjdk bot commented Jun 27, 2022 • edited

zzambers commented Jun 28, 2022 • edited

zzambers commented Jun 28, 2022

valeriepeng commented Jun 29, 2022

zzambers commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

valeriepeng commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

openjdk bot commented Jun 29, 2022

zzambers commented Jun 7, 2022 •

edited by openjdk bot

mlbridge bot commented Jun 22, 2022 •

edited

openjdk bot commented Jun 27, 2022 •

edited

zzambers commented Jun 28, 2022 •

edited