JRuby

Confusing (and late) OpenSSL error message

Details

  • Type: Bug Bug
  • Status: Resolved Resolved
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: None
  • Fix Version/s: JRuby-OSSL 0.7.7
  • Component/s: OpenSSL
  • Labels:
    None
  • Environment:
    Amazon EC2 small instance running Ubuntu 8.04
  • Testcase included:
    yes
  • Number of attachments :
    1

Description

I'm seeing inconsistencies and errors in encrypting/decrypting with jruby-openssl on my EC2 instance. However, everything works fine on my Mac.

OSX 10.6.2 – All is well here

$ java -version
java version "1.6.0_17"
Java(TM) SE Runtime Environment (build 1.6.0_17-b04-248-10M3025)
Java HotSpot(TM) 64-Bit Server VM (build 14.3-b01-101, mixed mode)

$ ruby -v
ruby 1.8.7 (2008-08-11 patchlevel 72) [universal-darwin10.0]

$ ruby ./openssl-test.rb 
dF5wf1txacDI8THpPchSow==
hello world

$ jruby -v
jruby 1.4.0 (ruby 1.8.7 patchlevel 174) (2009-11-02 69fbfa3) (Java HotSpot(TM) 64-Bit Server VM 1.6.0_17) [x86_64-java]

$ jgem list | grep openssl
jruby-openssl (0.5.2)

$ jruby ./openssl-test.rb 
dF5wf1txacDI8THpPchSow==
hello world

.. snip jruby-openssl upgrade ..

$ jgem list | grep openssl
jruby-openssl (0.6)

$ jruby ./openssl-test.rb 
dF5wf1txacDI8THpPchSow==
hello world

Ubuntu 8.04 on EC2 - MRI works fine, but both 0.5.2 and 0.6.0 versions of jRuby-OpenSSL product bad results

$ java -version
java version "1.6.0_17"
Java(TM) SE Runtime Environment (build 1.6.0_17-b04)
Java HotSpot(TM) Client VM (build 14.3-b01, mixed mode, sharing)

$ ruby -v
ruby 1.8.6 (2007-09-24 patchlevel 111) [i486-linux]

$ ruby ./openssl-test.rb 
dF5wf1txacDI8THpPchSow==
hello world

$ ./jruby -v
jruby 1.4.0 (ruby 1.8.7 patchlevel 174) (2009-11-02 69fbfa3) (Java HotSpot(TM) Client VM 1.6.0_17) [i386-java]

$ ./jruby -S gem list | grep openssl
jruby-openssl (0.5.2)

$ ./jruby ./openssl-test.rb 
bTpKPcb5aXzjVnSpRoIc/Q==
hello world

.. snip jruby-openssl upgrade ..

$ ./jruby -S gem list | grep openssl
jruby-openssl (0.6)

$ ./jruby ./openssl-test.rb 
./openssl-test.rb:11: Illegal key size (OpenSSL::Cipher::CipherError)

Please note that in addition to the 0.6.0 error, the encrypted string for 0.5.2 is incorrect

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Hiroshi Nakamura added a comment -

You need to override JCE Unlimited Strength Jurisdiction Policy Files (local_policy.jar and US_export_policy.jar) in $JAVA_HOME/jre/lib/security/ to use AES256. I don't know Amazon EC2 allows it or not...

Can you change cipher spec to AES128 for a workaroud?

Show
Hiroshi Nakamura added a comment - You need to override JCE Unlimited Strength Jurisdiction Policy Files (local_policy.jar and US_export_policy.jar) in $JAVA_HOME/jre/lib/security/ to use AES256. I don't know Amazon EC2 allows it or not... Can you change cipher spec to AES128 for a workaroud?
Hide
Permalink
Michael Rykov added a comment - - edited

Thanks for the insight – both solutions worked as you described.

1. Changing the Cipher init string to 'aes-128-cbc' produces "bTpKPcb5aXzjVnSpRoIc/Q==" across the board (the same result that jruby-openssl 0.5.2 produced above).
2. Installing the JCE Unlimited Strength files fixed the issue with AES256.

–

So this isn't really an issue in functionality, but rather the error messaging. I would prefer to see "unsupported cipher algorithm" for Cipher.new('aes-256-cbc') instead of the key size error on cipher.final.

Show
Michael Rykov added a comment - - edited Thanks for the insight – both solutions worked as you described. 1. Changing the Cipher init string to 'aes-128-cbc' produces "bTpKPcb5aXzjVnSpRoIc/Q==" across the board (the same result that jruby-openssl 0.5.2 produced above). 2. Installing the JCE Unlimited Strength files fixed the issue with AES256. – So this isn't really an issue in functionality, but rather the error messaging. I would prefer to see "unsupported cipher algorithm" for Cipher.new('aes-256-cbc') instead of the key size error on cipher.final.
Hide
Permalink
Vladimir Sizikov added a comment -

I've adjusted the subject of this bug to be in sync with the content.

Indeed, in JRuby, creating a Cipher with arbitrary name doesn't fail, but succedes, and only later the confusing error is produced with "Illegal key size" text.

MRI raises an Error right away, once it sees the wrong/missig/unsupported algorithm.

For example:

OpenSSL::Cipher::Cipher.new('aes-xxxxxxx')

is successful in JRuby, and correctly fails in MRI.

Show
Vladimir Sizikov added a comment - I've adjusted the subject of this bug to be in sync with the content. Indeed, in JRuby, creating a Cipher with arbitrary name doesn't fail, but succedes, and only later the confusing error is produced with "Illegal key size" text. MRI raises an Error right away, once it sees the wrong/missig/unsupported algorithm. For example: OpenSSL::Cipher::Cipher. new ('aes-xxxxxxx') is successful in JRuby, and correctly fails in MRI.
Vladimir Sizikov made changes -
Field Original Value New Value
Summary AES 256 inconsistencies and errors across platforms Confusing (and late) OpenSSL error message
Hide
Permalink
Hiroshi Nakamura added a comment -

Just committed: master:8c440685b518886d448177cfb2bb7ba19e31d60d

check unsupported cipher algorithm at initialization.

follow CRuby's openssl behavior.

CAUTION: at this time, JRE's security policy is not checked at
initialization time so Cipher.new("aes-256-cbc") is allowed even if the
env does not have JCE Unlimited Strength Jurisdiction Policy Files. For
such environment, you get an CipherError "Illegal key size" at usage
time. Should be fixed in the future.

Show
Hiroshi Nakamura added a comment - Just committed: master:8c440685b518886d448177cfb2bb7ba19e31d60d check unsupported cipher algorithm at initialization. follow CRuby's openssl behavior. CAUTION: at this time, JRE's security policy is not checked at initialization time so Cipher.new("aes-256-cbc") is allowed even if the env does not have JCE Unlimited Strength Jurisdiction Policy Files. For such environment, you get an CipherError "Illegal key size" at usage time. Should be fixed in the future.
Hiroshi Nakamura made changes -
Assignee Hiroshi Nakamura [ nahi ]
Hide
Permalink
Hiroshi Nakamura added a comment -

changed priority Major -> Minor. Compat is important but not so match as unimplemented features and crash bugs.

Show
Hiroshi Nakamura added a comment - changed priority Major -> Minor. Compat is important but not so match as unimplemented features and crash bugs.
Hiroshi Nakamura made changes -
Priority Major [ 3 ] Minor [ 4 ]
Fix Version/s JRuby-OpenSSL 0.5.3 [ 15873 ]
Thomas E Enebo made changes -
Affects Version/s JRuby-OpenSSL 0.5.2 [ 15435 ]
Thomas E Enebo made changes -
Affects Version/s JRuby-OpenSSL 0.5.3 [ 15873 ]
Hide
Permalink
Hiro Asari added a comment -

Not sure what we can do here, but I spent some time figuring this one out. Can we give a more appropriate message?

Show
Hiro Asari added a comment - Not sure what we can do here, but I spent some time figuring this one out. Can we give a more appropriate message?
Hide
Permalink
Hiroshi Nakamura added a comment -

Hope this message help users.

commit 6731933bb0cd4362d28e9797fb0b237ffbbf363c
Author: Hiroshi Nakamura <nahi@ruby-lang.org>
Date:   Mon Apr 30 14:53:06 2012 +0900

    JRUBY-4326: Confusing (and late) OpenSSL error message
    
    Notice the JCE restriction to users when InvalidKeyException is raised.
    This exception also thrown when IV length or key length is wrong but
    those length should be checked before initialization.
Show
Hiroshi Nakamura added a comment - Hope this message help users. commit 6731933bb0cd4362d28e9797fb0b237ffbbf363c Author: Hiroshi Nakamura <nahi@ruby-lang.org> Date: Mon Apr 30 14:53:06 2012 +0900 JRUBY-4326: Confusing (and late) OpenSSL error message Notice the JCE restriction to users when InvalidKeyException is raised. This exception also thrown when IV length or key length is wrong but those length should be checked before initialization.
Hiroshi Nakamura made changes -
Status Open [ 1 ] Resolved [ 5 ]
Fix Version/s JRuby-OSSL 0.7.7 [ 18461 ]
Resolution Fixed [ 1 ]

People

  • Assignee:
    Hiroshi Nakamura
    Reporter:
    Michael Rykov
Vote (1)
Watch (2)

Dates

  • Created:
    Updated:
    Resolved: