PropertiesLauncher fails to load PBKDF-OpenSSL of bcprov-jdk15on-1.64.jar

[ziqianggeoffreychen]

Spring Boot version: 2.3.1.RELEASE

The bouncy castle jar is embedded into spring boot fat jar, while JarLauncher can load the exactly same PBKDF-OpenSSL algorithm, PropertiesLauncher fails to load. Below is the exception:

Caused by: java.security.NoSuchAlgorithmException: PBKDF-OpenSSL SecretKeyFactory not available
	at javax.crypto.SecretKeyFactory.<init>(SecretKeyFactory.java:122)
	at javax.crypto.SecretKeyFactory.getInstance(SecretKeyFactory.java:160)
	at org.bouncycastle.jcajce.util.DefaultJcaJceHelper.createSecretKeyFactory(Unknown Source)
	... 72 common frames omitted

After troubleshooting into javax.crypto.SecretKeyFactory, below eaten exception is identified as the root cause:

spring-boot/spring-boot-project/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarFile.java

Lines 363 to 367 in 8464cfb

	private void ensureOpen() {
	if (this.closed) {
	throw new IllegalStateException("zip file closed");
	}
	}

Why would it behave differently between JarLauncher and PropertiesLauncher on this SecretKeyFactory?

Full "zip file closed" exception stack trace by IntelliJ IDEA:

<init>(String):-1, IllegalStateException (java.lang), Unknown Source
ensureOpen():365, JarFile (org.springframework.boot.loader.jar), JarFile.java
getEntry(String):266, JarFile (org.springframework.boot.loader.jar), JarFile.java
getJarEntry(String):257, JarFile (org.springframework.boot.loader.jar), JarFile.java
setupEntryCertificates(JarEntry):420, JarFile (org.springframework.boot.loader.jar), JarFile.java
getCertificates():91, JarEntry (org.springframework.boot.loader.jar), JarEntry.java
verifySingleJar(URL):497, JarVerifier (javax.crypto), JarVerifier.java
verifyJars(URL, List):363, JarVerifier (javax.crypto), JarVerifier.java
verify():289, JarVerifier (javax.crypto), JarVerifier.java
verifyProviderJar(URL):164, JceSecurity (javax.crypto), JceSecurity.java
getVerificationResult(Provider):190, JceSecurity (javax.crypto), JceSecurity.java
canUseProvider(Provider):204, JceSecurity (javax.crypto), JceSecurity.java
nextSpi(SecretKeyFactorySpi):295, SecretKeyFactory (javax.crypto), SecretKeyFactory.java
<init>(String):121, SecretKeyFactory (javax.crypto), SecretKeyFactory.java
getInstance(String):160, SecretKeyFactory (javax.crypto), SecretKeyFactory.java
createSecretKeyFactory(String):-1, DefaultJcaJceHelper (org.bouncycastle.jcajce.util), Unknown Source
getKey(JcaJceHelper, char[], String, int, byte[], boolean):-1, PEMUtilities (org.bouncycastle.openssl.jcajce), Unknown Source
getKey(JcaJceHelper, char[], String, int, byte[]):-1, PEMUtilities (org.bouncycastle.openssl.jcajce), Unknown Source
crypt(boolean, JcaJceHelper, byte[], char[], String, byte[]):-1, PEMUtilities (org.bouncycastle.openssl.jcajce), Unknown Source
decrypt(byte[], byte[]):-1, JcePEMDecryptorProviderBuilder$1$1 (org.bouncycastle.openssl.jcajce), Unknown Source
decryptKeyPair(PEMDecryptorProvider):-1, PEMEncryptedKeyPair (org.bouncycastle.openssl), Unknown Source
convertEncryptedPrivateKey(String, String):135, SignKeyProviderPemImpl (com.ericsson.jee.iam.saml.keyprovider), SignKeyProviderPemImpl.java

[wilkinsona]

Why would it behave differently between JarLauncher and PropertiesLauncher on this SecretKeyFactory?

That will depend on how you have created and configured the PropertiesLauncher. If you would like us to spend some more time investigating, please spend some time providing a complete yet minimal sample that reproduces the problem. You can share it with us by pushing it to a separate repository on GitHub or by zipping it up and attaching it to this issue.

[ziqianggeoffreychen]

Hi Andy,

Thanks for your prompt response and beautify my initial post. Please clone my reproduction code from this repo and refer to the Readme document if needed: https://github.com/ziqianggeoffreychen/spring-boot-properties-launcher-with-broken-bcp

[wilkinsona]

Thanks for the sample, @ziqianggeoffreychen. Unfortunately, it does fail for me but with a different error. This is the failure that I get when launching the application with java -jar on macOS:

2020-09-02 17:06:06.216 ERROR 80131 --- [           main] c.e.restservice.RestServiceApplication   : Failed to convert private key
Exception in thread "main" java.lang.reflect.InvocationTargetException
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
	at org.springframework.boot.loader.Launcher.launch(Launcher.java:109)
	at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
	at org.springframework.boot.loader.PropertiesLauncher.main(PropertiesLauncher.java:466)
Caused by: java.lang.RuntimeException: Failed to convert private key
	at com.example.restservice.RestServiceApplication.convertEncryptedPrivateKey(RestServiceApplication.java:70)
	at com.example.restservice.RestServiceApplication.main(RestServiceApplication.java:38)
	... 8 more
Caused by: org.bouncycastle.openssl.EncryptionException: exception using cipher - please check password and data.
	at org.bouncycastle.openssl.jcajce.PEMUtilities.crypt(Unknown Source)
	at org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder$1$1.decrypt(Unknown Source)
	at org.bouncycastle.openssl.PEMEncryptedKeyPair.decryptKeyPair(Unknown Source)
	at com.example.restservice.RestServiceApplication.convertEncryptedPrivateKey(RestServiceApplication.java:63)
	... 9 more
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
	at com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:975)
	at com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:1056)
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:853)
	at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)
	at javax.crypto.Cipher.doFinal(Cipher.java:2168)
	... 13 more

I see the same problem when launching the application in my IDE (having removed the classpath: prefix when accessing the resources as streams). Can you please update the sample so that it reproduces the behaviour that's specific to PropertiesLauncher?

[ziqianggeoffreychen]

Hi @wilkinsona, I have git clone the code in Linux (RHEL 7.6) and get the same error. I will find a macOS to verify if the result will change. At the same time, I would like to know your Java version. I am using Oracle JDK 1.8.0. On Windows 10, it is 1.8.0_251, while on RHEL it is 1.8.0_241. If it is caused by compatible issue between macOS and Windows, I will figure out a way to generate the PEM files from scratch. Thanks and regards.

[ziqianggeoffreychen]

I verified macOS (10.14.6), and reproduced the issue. The point here is Java version should be 1.8.0. I used maven 3.6.3 but I guess that's not the key factor. @wilkinsona, I updated the project to compare ZIP and JAR layout: ZIP layout (PropertiesLauncher) results in NoSuchAlgorithmException, on the other hand, JAR layout (JarLauncher) is normal. Could you git pull and try again? Thanks.

[wilkinsona]

Thanks for the updates, @ziqianggeoffreychen. Unfortunately, I'm still unable to reproduce the problem. I'm using Java 8:

$ java -version
openjdk version "1.8.0_252"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_252-b09)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.252-b09, mixed mode)

The application runs successfully:

$ java -jar target/spring-boot-properties-launcher-with-broken-bcp-0.0.1-SNAPSHOT.jar

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::        (v2.3.1.RELEASE)

2020-09-03 09:49:02.632  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Starting RestServiceApplication v0.0.1-SNAPSHOT on wilkinsona-a01.vmware.com with PID 21819 (/Users/awilkinson/dev/temp/spring-boot-properties-launcher-with-broken-bcp/target/spring-boot-properties-launcher-with-broken-bcp-0.0.1-SNAPSHOT.jar started by awilkinson in /Users/awilkinson/dev/temp/spring-boot-properties-launcher-with-broken-bcp)
2020-09-03 09:49:02.635  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : No active profile set, falling back to default profiles: default
2020-09-03 09:49:03.398  INFO 21819 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
2020-09-03 09:49:03.405  INFO 21819 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2020-09-03 09:49:03.406  INFO 21819 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.36]
2020-09-03 09:49:03.449  INFO 21819 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
2020-09-03 09:49:03.449  INFO 21819 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 766 ms
2020-09-03 09:49:03.576  INFO 21819 --- [           main] o.s.s.concurrent.ThreadPoolTaskExecutor  : Initializing ExecutorService 'applicationTaskExecutor'
2020-09-03 09:49:03.706  INFO 21819 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 8080 (http) with context path ''
2020-09-03 09:49:03.716  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Started RestServiceApplication in 1.463 seconds (JVM running for 2.314)
2020-09-03 09:49:03.736  INFO 21819 --- [           main] o.s.s.concurrent.ThreadPoolTaskExecutor  : Shutting down ExecutorService 'applicationTaskExecutor'
2020-09-03 09:49:03.736  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Start to get certificate
2020-09-03 09:49:03.883  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Successfully get certificate:   [0]         Version: 3
         SerialNumber: 4098
             IssuerDN: C=CN,ST=IDP,O=IDP,OU=IDP,CN=IDP
           Start Date: Mon Jan 13 07:00:28 GMT 2020
           Final Date: Thu Jan 10 07:00:28 GMT 2030
            SubjectDN: C=CN,ST=IDP,O=IDP,OU=IDP,CN=IDP
           Public Key: RSA Public Key [eb:30:b4:21:24:d1:f7:a4:7b:0b:29:73:d7:1c:ca:d5:60:33:26:6b],[56:66:d1:a4]
        modulus: cd198475b2aae40a2c664b03e37ca01939a066a2f0056cbf374bb6b8467bbcc4505a7bb812edcf9de1f3cfae2fbfb536597482fc477b954bed5d8177a1f33806b050b4d63df7f36c67cb140be77dc1208563461a8b654627536b0533806b3977c671ce06e08013babc0353307e1d450befb474f92f161922f333e99f560db29d16b7fddb6a7e86998421aeff5da03351e43ff62ee1b4dfd725971adf97a60f4be4400783c74553d14d094cb920c87179a823745af9e43551d2022d95a9e522c48e38d9c3292d997447db380bfa842ea92219b1c107649af8f7640d062bcdd950ed5c080786d41f96ed667463d7858e9e889b6b81efc1ddca771759a238cccff9
public exponent: 10001

  Signature Algorithm: SHA256WITHRSA
            Signature: 72ee82487d59132cfcbb91c7029a3c80451f204b
                       870b8bac450013bf4018b301ed6869849e74b234
                       8a1d44744e28fdcd233f7bf54f0471ca3d805354
                       ffbda5e1d84b35024861c604de7e820788b1133b
                       959f6f2722bcc8ce3b1adbf420635150412df98c
                       e0763e344906181af8a560336a8bca6df4285a69
                       8a6e1d9fb5b8f059aca43b1af5ce4152bb68b3be
                       683535edd325554c6b2806e8201909f21e86e9b8
                       9185859ecbed96e0e5f69d2147d21687f2e25fef
                       de1236e63ae94db983cbe8f6d0fd4238e7b08449
                       9fba16b0d8502abeec51d4040dbc1ee58fa46cf3
                       4eabe26c66c60f856f3780d9cbaabffce1714e57
                       1a11226cc4dc1efd0d2ea53b15262016
       Extensions: 
                       critical(false) BasicConstraints: isCa(false)
                       critical(false) 2.16.840.1.113730.1.13 value = IA5String(OpenSSL Generated Certificate) 

                       critical(false) 2.5.29.14 value = DER Octet String[20] 

                       critical(false) 2.5.29.35 value = Sequence
    Tagged [0] IMPLICIT 
        DER Octet String[20] 


2020-09-03 09:49:03.885  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Try to get RSA private key via PEM:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6400DD952EEE60C4CDE60B6C5C11C026

DzdbEOz0XX56xAPagw5mIqmW5gPoGYaC+IPAqtwUZhO7RYQcA1tgE4N+aALZg0Q/
y97fQ0q1ww5RBDMKj8CzZacpVLJaJEQw/TZhUIPOGYRWfLIxZZ4Q4KdzbuWolt2P
yI9ZL/sFDfTJXnSOHN9kKX3hnuyW0EVZzaoL45SFbnJ2pu8elx4jy7VcT8FIcD4o
aERx89IB9rUXGPYcVtLGqziPg8fMV+YkKvM7qV/0LTSIRqwisZm6pxvUIPUVudTb
/hmIvr0ZGCTZwVFJBUmt81v2CovVUd83UaPmLiDbmCq4askfWGCIcWAeooQZj66f
6c7vgrk98SrL27h1qLUjdVVP29CU1u+qG9+3cCaEc7ufalZ+LihyTHe8rJFzBpwb
hbdUT4VWQXoiUBlMZrpzPaoLTSywfu+8gymIogy2l4udj943YeFEWgJQPxIQZISX
uKhVZ92jbYZYd+fogDIgvPUrUJBr0YrsCwik1o5IfEBFClgFDHkfKZkF1F7BwL4o
a9KswjmZpgIPDkqauVdTf9zwmFgcKC7ojc9lVdl4HXi+mDt0UcGfeH9Vahv1I16y
okLh60OC4+rGNtyVP/nhXoilCpYpq5F4HDZ8+6DFdi6i3BQgGF73nRa+ngfsgoPz
m1LM/vbz507pLns69PxTvxPVyLXpKbJdNV+OodR4tSNjsrCWbxIZPayNIfp23QC6
YctnhQNaGuJz3tSz/YwaSn7aN7aV+LBSoUf+c5Rj9OLh69lXkpyBAhRZudU185an
LMCMR6el6g4NkGG+gEYpz7Ux73ScIB9TTu3rzSxZPY+VCKeL7jm2gFN+lZpzO0p5
3pXTHQ1jOn8Wn21MK03PaBHkaNJu92v7zhsTi1fW6szOuLJtHzo+q6mNpp/G5cuM
oAx6Zjb88YE+iEfuo2+MG0j8oIlhtG5CC4ZuoB05Am9FRQmbZBg4pGgBld8Wq5bk
i84mV20eZ4iZg8IKFaIif+rNKBG0DTLzgTLTHKCP1x7YtyDh37DkiIqE62y+QNhd
DrVCFY2hH0Kw27LWSCmZt3gv5jgctofDMi3FEz/Uq5/ZFZVnTYeSvjDsBLObwoIC
21jKAVZoOgsRyK898A2Xni1DVWAxTafCkyxSuzGoVxnPkBGvgy33grZzOpE8/9Pl
2Z2nVZhhUMeeviIFyrfJ7vhuTyRLwxOntk0AfNT/tUqe/3JBJ4hFmyvqvBYtT7Jl
d9DApc10dFIFYQYNiBMXnqsqQmmocHujRU3QMFqDDcUDsepTmuTYfL+gr9fDwQQ9
Qaz/f3/+fHFYKn0XGdjDQOZ7ZQrZhdRnwBJAju0CBrwWD9K8SnySZ3I9qxWP2ASo
0FPmJmeD2hyx34N4WFpUfVJUQ4bm1czC/I8NNHD2azpURc9LqhARCtwTYJzsDE4G
igm0MSOnwoEv/oSm0xbbAcNAQhVxfbmdn43mw8FmXYZAbiWExBDS6QtNdTyJMbCt
izlEq5hZRQPYQwhKsQF6+ikSdMsFmoaz5YjXadgI9LEBn+oz6L7HU7RXEkaKOalA
zS3BdF3YytMqqxp6bPfohVLJ/w/F3w60/qKHkeTiHMbjDeDdWMVnf+xHcwXnU3on
-----END RSA PRIVATE KEY-----

2020-09-03 09:49:03.937  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Successfully get private keyRSA Private CRT Key [eb:30:b4:21:24:d1:f7:a4:7b:0b:29:73:d7:1c:ca:d5:60:33:26:6b],[56:66:d1:a4]
             modulus: cd198475b2aae40a2c664b03e37ca01939a066a2f0056cbf374bb6b8467bbcc4505a7bb812edcf9de1f3cfae2fbfb536597482fc477b954bed5d8177a1f33806b050b4d63df7f36c67cb140be77dc1208563461a8b654627536b0533806b3977c671ce06e08013babc0353307e1d450befb474f92f161922f333e99f560db29d16b7fddb6a7e86998421aeff5da03351e43ff62ee1b4dfd725971adf97a60f4be4400783c74553d14d094cb920c87179a823745af9e43551d2022d95a9e522c48e38d9c3292d997447db380bfa842ea92219b1c107649af8f7640d062bcdd950ed5c080786d41f96ed667463d7858e9e889b6b81efc1ddca771759a238cccff9
     public exponent: 10001

2020-09-03 09:49:03.937  INFO 21819 --- [           main] c.e.restservice.RestServiceApplication   : Test is done. Now exit.

[wilkinsona]

I've just tried in a Windows 10 VM and it works there too. Unfortunately, I don't think we're going to be able to make any progress on this one without a sample that reproduces the problem.