SSL handshake - java.security.InvalidAlgorithmParameterException issue

Need your advice for a java problem.

Currently we have an issue while accessing the web service using java code.
Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL.
We have java version 1.6.0.10 in production.

When we are executing the code, we are getting error –

Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)

        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)

        ... 6 more

Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)

        at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)

        at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100)         ... 13 more

This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495

In above links, I found below statement –

CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.

We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue?
Do we need server side changes for bouncycastle implementation? Or we can use in client side only?
Any advice on solving this issue is highly appreciated.

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

Update your Java 6 to version 6u171 or later (no need to upgrade).

– rustyx
Nov 21 '18 at 13:07

add a comment |

Need your advice for a java problem.

When we are executing the code, we are getting error –

Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)

        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)

        ... 6 more

Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)

        at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)

        at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100)         ... 13 more

This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495

In above links, I found below statement –

CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

Update your Java 6 to version 6u171 or later (no need to upgrade).

– rustyx
Nov 21 '18 at 13:07

add a comment |

Need your advice for a java problem.

When we are executing the code, we are getting error –

Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)

        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)

        ... 6 more

Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)

        at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)

        at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100)         ... 13 more

This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495

In above links, I found below statement –

CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

Need your advice for a java problem.

When we are executing the code, we are getting error –

Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)

        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)

        ... 6 more

Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)

        at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)

        at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100)         ... 13 more

This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495

In above links, I found below statement –

CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.

java ssl java-6

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

edited Nov 21 '18 at 13:03

lospejos

1,44221426

edited Nov 21 '18 at 13:03

lospejos

1,44221426

edited Nov 21 '18 at 13:03

lospejos

1,44221426

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

asked Nov 21 '18 at 12:09

Nachiket Bapat

261

Update your Java 6 to version 6u171 or later (no need to upgrade).

– rustyx
Nov 21 '18 at 13:07

add a comment |

Update your Java 6 to version 6u171 or later (no need to upgrade).

– rustyx
Nov 21 '18 at 13:07

Update your Java 6 to version 6u171 or later (no need to upgrade).

– rustyx
Nov 21 '18 at 13:07

add a comment |

1 Answer
1

active

oldest

votes

The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.

And the configuration required can be found in To configure a JCE Provider.

After the configuration is done. Print the security providers information like the following code.

Provider  providers = Security.getProviders();

for (int i = 0; i != providers.length; i++)

{

     System.out.println(providers[i].getInfo());

}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)

answered Nov 21 '18 at 14:15

samabcde

1,0551412

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53411739%2fssl-handshake-java-security-invalidalgorithmparameterexception-issue%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Provider  providers = Security.getProviders();

for (int i = 0; i != providers.length; i++)

{

     System.out.println(providers[i].getInfo());

}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)

answered Nov 21 '18 at 14:15

samabcde

1,0551412

add a comment |

Provider  providers = Security.getProviders();

for (int i = 0; i != providers.length; i++)

{

     System.out.println(providers[i].getInfo());

}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)

answered Nov 21 '18 at 14:15

samabcde

1,0551412

add a comment |

Provider  providers = Security.getProviders();

for (int i = 0; i != providers.length; i++)

{

     System.out.println(providers[i].getInfo());

}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)

answered Nov 21 '18 at 14:15

samabcde

1,0551412

Provider  providers = Security.getProviders();

for (int i = 0; i != providers.length; i++)

{

     System.out.println(providers[i].getInfo());

}

See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)

answered Nov 21 '18 at 14:15

samabcde

1,0551412

answered Nov 21 '18 at 14:15

samabcde

1,0551412

answered Nov 21 '18 at 14:15

samabcde

1,0551412

answered Nov 21 '18 at 14:15

samabcde

1,0551412

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu