2

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work. Will any policy or setting change make it work?

Thanks in advance.

Improve this question
4
  • 1
    The providers in Oracle Java or OpenJDK, unless changed by an installation, do not as I noted on your SO question
    – dave_thompson_085
    Apr 29, 2022 at 1:51
  • @dave_thompson_085 Thanks. I saw your updated comment. Also, what does "unless changed by an installation" imply? I am searching for workarounds but no luck till now.
    – Amal Jesudas
    Apr 29, 2022 at 13:46
  • Things like adding bc{tls,prov} jars and configuring java.security, like in your new Q, are changing the installation i.e. the set of files that contain a JRE or JDK and were created by installing such.
    – dave_thompson_085
    Apr 29, 2022 at 21:06
  • The CCM cipher suites are not at all common. GCM is faster when hardware supports the proper instructions, and most modern processors do.
    – bk2204
    Apr 29, 2022 at 21:13

2 Answers 2

Reset to default
4

This is very dependent on the version on the JRE that you are using, and thus on the version of JSSE it ships. It also depends on your local configuration, notably the jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system properties.

The definitive answer is obtainable for your JRE as configured by you by running the following code

SSLContext context = SSLContext.getDefault();
SSLSocketFactory ssf = context.getSocketFactory();
String[] cipherSuites = ssf.getSupportedCipherSuites();

and examining the cipher suites returned.

BTW, BouncyCastle implements more cipher suites, including the one you seem to need, see https://github.com/bcgit/bc-java/wiki/Provider-Installation for how to install.

Improve this answer
5
  • Thanks for the link on provider installation. I added that to my java.security file but see no difference in behavior. I have not previously dealt with security related configurations in java. So my knowledge is very limited. Is updating java.security file the only requirement for using BouncyCastle as the security provider or is there something more to do?
    – Amal Jesudas
    Apr 29, 2022 at 13:49
  • 1
    It's order dependent, has BC the lowest number of all the providers? For this specific problem possibly better ressources on Stackoverflow
    – Bruno Rohée
    Apr 29, 2022 at 14:07
  • No. Out of a total of 14 providers, I put Bouncy Castle at 4th position above SunJSSE.
    – Amal Jesudas
    Apr 29, 2022 at 14:24
  • Check which SocketFactory is returned if you cannot specify it explicitly. At this point it's more a Stackoverflow question anyway a
    – Bruno Rohée
    Apr 29, 2022 at 15:18
  • 2
    The 'basic' provider org.bouncycastle.jce.provider.BouncyCastleProvider in bcprov[-ext]-$version.jar doesn't include TLS; for that you need the separate provider org.bouncycastle.jsse.provider.BouncyCastleJsseProvider in bctls-$version.jar (and for CCM in TLS AFAICT you need both). OP did go to stackoverflow.com/questions/72060766 as suggested .
    – dave_thompson_085
    Apr 30, 2022 at 2:44
2

Dave and Bruno have provided the main solution for the issue. These are the steps I did to solve my issue:

  1. Downloaded and added files bcprov-$version.jar and bctls-$version.jar to %JAVA_HOME%\lib\ext .
  2. Updated java.security file with security.provider.N=org.bouncycastle.jce.provider.BouncyCastleJsseProvider
  3. Updated java.security file with security.provider.(N+1)=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider

The tool now gave below error:

Exception in thread "main" java.lang.NoClassDefFoundError:
org/bouncycastle/asn1/eac/EACObjectIdentifiers at
org.bouncycastle.tls.TlsUtils.createCertSigAlgOIDs(Unknown Source)

So added bcutil-$version.jar also to %JAVA_HOME%\lib\ext and my tool worked.

Improve this answer
1
  • 1
    Good catch -- I didn't know they'd added a dependency on bcutil (which was only created as of 1.69).
    – dave_thompson_085
    May 3, 2022 at 2:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .