RH2023467: Enable FIPS keys export

[franferrax]

Search this PR in Red Hat Jira

Diff of this PR only	Dependency chain
6afe961...0cb2359 (including ff26db7) ff26db7...0cb2359 (excluding ff26db7)	rh-openjdk:fips ← #1 ← #5 ← THIS PR

RH2023467: Enable the export of keys in plain from the NSS Software Token while in FIPS mode

A backport of rh-openjdk/jdk#1, which also includes rh-openjdk/jdk#14 (a follow-up issue found in the first PR).

NOTE: I've created the branch starting from #5's 6afe961 (which is a dependency for certain changes).

References

• Multi-versions epics
  • RHELPLAN-112617: Enable the export of keys in plain from the NSS Software Token while in FIPS mode
  • RHELPLAN-127158: Avoid import/export of DH private keys
• 17u Bugzilla tickets (for RHEL 8)
  • RH2023467: Enable the export of keys in plain from the NSS Software Token while in FIPS mode [rhel-8, openjdk-17]
  • RH2104724: Avoid import/export of DH private keys [rhel-8, openjdk-17]
• 11u Bugzilla tickets (for RHEL 8)
  • RH2029653: Enable the export of keys in plain from the NSS Software Token while in FIPS mode [rhel-8, openjdk-11]
  • RH2133879: Avoid import/export of DH private keys [rhel-8, openjdk-11]

Pull request creation procedure

1. Create branch starting from 6afe961

   git switch --create=RH2023467 6afe961de4e757d798e0e38b49cf73e992afa39d

2. Backport JDK-6676643: Improve current C_GetAttributeValue native implementation (it applies almost clean except for a trivial conflict in a copyright)

   git fetch https://github.com/openjdk/jdk 7ab6dc83df2e19a57ff0dcdc87598c54cd949a7c
   git cherry-pick --no-commit 7ab6dc83df2e19a57ff0dcdc87598c54cd949a7c
   
   # Fix trivial copyright dates conflict in PKCS11.java and commit
   sed -i '2,4d;6d' src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
   git commit -a -m "Backport JDK-6676643: Improve current C_GetAttributeValue native implementation
   
   openjdk/jdk@7ab6dc83df2e19a57ff0dcdc87598c54cd949a7c
   https://bugs.openjdk.org/browse/JDK-6676643
   "

3. Backport rh-openjdk/jdk@bd324bd and rh-openjdk/jdk@7585508

   git fetch https://github.com/rh-openjdk/jdk bd324bda437a924e58730cc67c133275e8203780 7585508387dc78ea6a04154ed3727e6f1fb4c9b4
   git cherry-pick --edit bd324bda437a924e58730cc67c133275e8203780 7585508387dc78ea6a04154ed3727e6f1fb4c9b4

4. Fix conflicts (see the Conflicts section below)
5. Execute git cherry-pick --continue and edit commit messages to remove the original PR numbers from the rh-openjdk/jdk repo, and to add references to the back-ported commit hashes
6. Adapt non-conflicted code to work in 11u (see the Additional required changes section below), commit changes
7. Remove objects from foreign repositories:

   git -c gc.pruneExpire=now -c gc.reflogExpire=now -c gc.reflogExpireUnreachable=now gc

Conflicts

• src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
  • Can't remove errorCode-only PKCS11Exception constructor added in rh-openjdk/jdk@abcd095, because this constructor hadn't been added in 8e0ea91, since it was still part of upstream 11u code (since 11u doesn't have JDK-6676643: Improve current C_GetAttributeValue native implementation)
    • Just dropped any change with:

    git restore --ours src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
    git add src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java

• src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
  • Can't cleanly apply the following changes because 11u doesn't have JDK-8242151: Improve OID mapping and reuse among JDK security providers for aliases registration, manually resolved:
    • Enable "RSA" algorithm of the KeyFactory service in FIPS (implemented in sun.security.rsa.RSAKeyFactory$Legacy)
    • Enable "RSASSA-PSS" algorithm of the KeyFactory service in FIPS (implemented in sun.security.rsa.PSSParameters)

Additional required changes

Once conflicts were solved, the following changes were required:

• 833d9b3
  • P11Key.java: SharedSecrets import in 11u has to be of jdk.internal.misc.SharedSecrets, and not jdk.internal.access.SharedSecrets
  • PKCS11.java: changes from 5c8832f require passing an extra null after rh-openjdk/jdk@bd324bd is applied
• c9c517a
  • FIPSKeyImporter.java: remove type and format parameters of sun.security.rsa.RSAPrivateCrtKeyImpl.newKey() (added in JDK-8023980: JCE doesn't provide any class to handle RSA private key in PKCS#1)
• 0cb2359
  • Add import static sun.security.pkcs11.wrapper.PKCS11Exception.*; to adapt code for introduced openjdk/jdk@7ab6dc8 backport (ff26db7)
  • Fix issue noted in this rh-openjdk/jdk#14 comment (addressed in Remove forgotten dead code from #13 and #14 jdk#21 for 17u)

[franferrax]

akashche/fips-whitebox tests have been successfully executed on a local build of this PR code.

I've also made some improvements to the test suite. That improved version also passed, see akashche/fips-whitebox#1.