SSL handshake - java.security.InvalidAlgorithmParameterException issue

Question

Need your advice for a java problem.

Currently we have an issue while accessing the web service using java code. Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL. We have java version 1.6.0.10 in production.

When we are executing the code, we are getting error –

Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
        ... 6 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
        at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
        at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100)         ... 13 more

This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060 https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495

In above links, I found below statement –

CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE implementation, which doesn't impose this restriction, or resorting to the BigNumber API directly.

We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue? Do we need server side changes for bouncycastle implementation? Or we can use in client side only? Any advice on solving this issue is highly appreciated.

Answer 1

The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.

Provider[]  providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
     System.out.println(providers[i].getInfo());
}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)