ckr_key_type_inconsistent：在使用NSS的SunPKCS11以FIPS模式派生时

发布于 2025-02-11 03:03:32 字数 1048 浏览 3 评论 0原文

环境详细信息： Java：OpenJDK-1.8.0.312 OS：RHEL8

以下是配置的安全提供商。 SUNPKCS11-NSS-FIPS，太阳1.8， Sunec 1.8， Sunjsse 1.8

注意：

当添加新的JCE时，问题消失了。添加Sunjce或BouncycastlefipsProvider安全提供商时工作。
已经确认了无限强度加密可用的（通过cipher.getmaxloweredkeylength（“ aes”）=〜大数）
）

Caused by: java.security.InvalidKeyException: init() failed
    at sun.security.pkcs11.P11Mac.engineInit(P11Mac.java:208)
    at javax.crypto.Mac.chooseProvider(Mac.java:350)
    at javax.crypto.Mac.init(Mac.java:415)
    at com.amazonaws.auth.AbstractAWSSigner.sign(AbstractAWSSigner.java:127)
    ... 36 common frames omitted
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_KEY_TYPE_INCONSISTENT
    at sun.security.pkcs11.wrapper.PKCS11.C_SignInit(Native Method)
    at sun.security.pkcs11.P11Mac.initialize(P11Mac.java:177)
    at sun.security.pkcs11.P11Mac.engineInit(P11Mac.java:206)
    ... 39 common frames omitted

请问吗？

原文

Environment details:
Java: openjdk-1.8.0.312
OS: RHEL8

Following are the security providers configured.
SunPKCS11-NSS-FIPS,
SUN 1.8,
SunEC 1.8,
SunJSSE 1.8

Note:

The issue disappears when added a new JCE. Worked when added SunJCE or BouncyCastleFipsProvider security provider.
Have confirmed unlimited strength crypto availabel (via Cipher.getMaxAllowedKeyLength("AES") =~ large number)

Caused by: java.security.InvalidKeyException: init() failed
    at sun.security.pkcs11.P11Mac.engineInit(P11Mac.java:208)
    at javax.crypto.Mac.chooseProvider(Mac.java:350)
    at javax.crypto.Mac.init(Mac.java:415)
    at com.amazonaws.auth.AbstractAWSSigner.sign(AbstractAWSSigner.java:127)
    ... 36 common frames omitted
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_KEY_TYPE_INCONSISTENT
    at sun.security.pkcs11.wrapper.PKCS11.C_SignInit(Native Method)
    at sun.security.pkcs11.P11Mac.initialize(P11Mac.java:177)
    at sun.security.pkcs11.P11Mac.engineInit(P11Mac.java:206)
    ... 39 common frames omitted

Any pointers please?

分享到QQ

分享到微博