Bespoke JCE Provider on IBM AIX

Question

I'm writing a new JCE Provider for a client, because I need to expose some custom Cipher. After extending CipherSpi and ProviderSpi, I'm ready to build. So I asked the client which version of Java they were targeting. They responded with:

# java -version
java version "1.6.0"
Java(TM) SE Runtime Environment (build pap3260sr9fp2-20110627_03(SR9 FP2)) IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 AIX ppc-32 jvmap3260sr9-20110624_85526 (JIT enabled, AOT enabled) J9VM - 20110624_085526 JIT  - r9_20101028_17488ifx17
GC   - 20101027_AA)
JCL  - 20110530_01
#

Damn. So they are using IBM Java 1.6.0 in an AIX machine.

I have written most of the bespoke JCE Provider to support the functionality required (using the How to Implement a Provider guide), extending ProviderSpi and CipherSpi abstract classes from the com.sun.* packages. Do I need to get the IBM Java JDK and extend the abstract classes from com.ibm.*? Or can I just get my JCE provider JAR signed using my Sun-rooted Java code-signing certificate, and plop it straight in to the right place on the AIX system? (One of these is daft, but I don't know which).

I just don’t know enough about JCE / JVM flavours to know if I now need an IBM-rooted Java code-signing certificate (if one even exists), or if the Sun-rooted signature is sufficient?

Answer 1

Both Oracle (Sun) and IBM JREs are using each other certificates to verify provider signature. So if you have provider signed using certificate from Sun it will work on IBM JRE. So yes - IBM-rooted Java code-signing certificate exists (the CA exists, it's almost impossible to obtain the cert even if you are inside IBM), but the Sun-rooted signature is sufficient. Your cryptographic provider will work on IBM JRE. You don't need to use any com.ibm package. Moreover it is possible to bypass provider signature requirement: Java HotSpot Cryptographic Provider signature verification issue

Detailed explanation

1. Certificates

The provider certificate verification is done by internal Java 1.6 JCE classes.

• in Oracle javax.crypto.SunJCE_b#a(X509Certificate c)
• in IBM javax.crypto.b#a(X509Certificate c)

The CA certificates used to verify signatures are stored in class files. In Oracle JVM as plain strings. IBM is doing this smarter - the certificate strings are obscured. To unobscure them you should use this piece of code:

final char[] key = {0x5f, 38, 3, 111, 110};

char[] decode(final char[] input) {
    final char[] output = new char[input.length];
    for (int i = 0; i < output.length; i++) {
        output[i] = (char)(input[i] ^ key[i % 5]);
    }
    return output;
}

So in the IBM Java 1.6 you can find CA code signing certificates:

• CN = JCE Code Signing CA, OU = Java Software Code Signing, O = Sun Microsystems Inc, L = Palo Alto, S = CA, C = US
• CN = JCE Code Signing CA, OU = IBM Code Signing, O = IBM Corporation, C = US
• CN = JCE Code Signing - Framework, OU = IBM Code Signing, O = IBM Corporation, C = US

2. Base provider classes

You should extend java.security.Provider class. For example com.ibm.crypto.provider.IBMJCE bundled with IBM JRE does it. (AFAIK there is no ProviderSpi class.) You should use javax.crypto.CipherSpi class too. For example com.ibm.crypto.provider.DESCipher from IBM provider does it.