From b6b593f2e919737ac8a019336ccaaca02d53623b Mon Sep 17 00:00:00 2001 From: Dmitry Litvintsev Date: Wed, 12 Aug 2026 11:12:31 -0500 Subject: [PATCH] common-security: add workaround bouncycastle EC algorithm name mismatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Motivation: ----------- commit 8de5c6f185e7cce71f05c3f83fe8b6814b54890d that tried to address "EC" vs "ECDSA" name mismatch. However the patch was insufficient and we ran into failure to start dCache when cert/key issued for dCache host used EC encryption algorithm Modification: ------------ "EC" and "ECDSA" are both used for elliptic-curve keys depending on provider and BouncyCastle version — treat them as equivalent. Result: ------- dCache starts normally w/ EC encrypted key/certs Target: trunk Request: 12.0, 11.2 Require-book: no Require-notes: yes Acked-by: Tigran Patch: https://rb.dcache.org/r/14746/ --- .../org/dcache/ssl/CanlContextFactory.java | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java b/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java index 8e36345ce67..cdeda661020 100644 --- a/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java +++ b/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java @@ -400,13 +400,19 @@ public KeyAndCertCredential0(PrivateKey privateKey, X509Certificate[] certificat } PublicKey pubKey = certificateChain[0].getPublicKey(); - String pubKeyAlgorithm = pubKey.getAlgorithm(); - // REVISIT: BouncyCastle uses "ECDSA" as the private key algorithm and "EC" as the public key algorithm names for elliptic curve keys. - if (!privateKey.getAlgorithm().equals(pubKeyAlgorithm) && !(privateKey.getAlgorithm().equals("ECDSA") && pubKeyAlgorithm.equals("EC"))) + String pubAlg = pubKey.getAlgorithm(); + String privAlg = privateKey.getAlgorithm(); + // "EC" and "ECDSA" are both used for elliptic-curve keys depending on the + // provider and BouncyCastle version — treat them as equivalent. + boolean privIsEC = privAlg.equals("EC") || privAlg.equals("ECDSA"); + boolean pubIsEC = pubAlg.equals("EC") || pubAlg.equals("ECDSA"); + + if (!privAlg.equals(pubAlg) && !(privIsEC && pubIsEC)) { throw new KeyStoreException("Private and public keys are not matching: different algorithms: " - + privateKey.getAlgorithm() + " vs. " + pubKeyAlgorithm); + + privAlg + " vs. " + pubAlg); + } - switch (pubKeyAlgorithm) { + switch (pubAlg) { case "DSA": if (!checkKeysViaSignature("SHA1withDSA", privateKey, pubKey)) throw new KeyStoreException("Private and public keys are not matching: DSA"); @@ -425,8 +431,9 @@ public KeyAndCertCredential0(PrivateKey privateKey, X509Certificate[] certificat if (!checkKeysViaSignature("GOST3411withECGOST3410", privateKey, pubKey)) throw new KeyStoreException("Private and public keys are not matching: EC GOST 34.10"); break; + case "EC": case "ECDSA": - if (!checkKeysViaSignature("SHA1withECDSA", privateKey, pubKey)) + if (!checkKeysViaSignature("SHA256withECDSA", privateKey, pubKey)) throw new KeyStoreException("Private and public keys are not matching: EC DSA"); break; }