Notes - Java and Bouncycastle

HCL Domino Domino Forum
1

Ok, this is pretty esoteric stuff, but maybe someone out there has tried this:

I am trying to use the BouncyCastle cryptography libraries inside a Notes java agent. But every time I try to add the provider in code, I get a security error:

The code to add a provider is simple:

Security.addProvider(new BouncyCastleProvider());

But I get the error:

at java.lang.SecurityManager.checkPermission(SecurityManager.java:576)

at COM.ibm.JEmpower.applet.AppletSecurity.checkSecurityPermission(AppletSecurity.java:1291)

at COM.ibm.JEmpower.applet.AppletSecurity.checkPermission(AppletSecurity.java:1475)

at COM.ibm.JEmpower.applet.AppletSecurity.checkPermission(AppletSecurity.java:1412)

at java.lang.SecurityManager.checkSecurityAccess(SecurityManager.java:1692)

at java.security.Provider.check(Provider.java:404)

at java.security.Provider.put(Provider.java:359)

at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(Unknown Source)

at JavaAgent.NotesMain(JavaAgent.java:12)

at lotus.domino.AgentBase.runNotes(Unknown Source)

at lotus.domino.NotesThread.run(Unknown Source)

I have put the BouncyCastle jar in \jvm\lib\ext so it should be given java.security.AllPermission.

I am stumped…

Simon

2

Subject: Notes - Java and Bouncycastle

Ok, i failed on my forum searching skills and evidently you cannot do this:

This confuses me greatly, as this was an old project that used to work under Notes 6.5.3. So addProvider WAS definitely working before.

What I have done is add the following line to java.security

security.provider.5=org.bouncycastle.jce.provider.BouncyCastleProvider

This means i can drop the addProvider line, as it is now setup when the JVM is started:

However… I know get the following problem

I need to use strong encryption, but the policy files in the domino jvm do not allow this, so I downloaded the Sun unrestricted policy files and get this:

java.lang.ExceptionInInitializerError

at javax.crypto.Mac.getInstance(Unknown Source)

at org.bouncycastle.jce.provider.JDKPKCS12KeyStore.engineLoad(Unknown Source)

at java.security.KeyStore.load(KeyStore.java:695)

at com.idiomsoftware.BCCertificate.LoadPKCS12(BCCertificate.java:420)

at com.idiomsoftware.DominoCertificateProfile.LoadCert(DominoCertificateProfile.java:75)

at com.idiomsoftware.DominoCertificateProfile.<init>(DominoCertificateProfile.java:22)

at JavaAgent.NotesMain(JavaAgent.java:41)

at lotus.domino.AgentBase.runNotes(Unknown Source)

at lotus.domino.NotesThread.run(Unknown Source)

Caused by: java.lang.SecurityException: Cannot set up certs for trusted CAs

at javax.crypto.e.<clinit>(Unknown Source)

... 9 more

Caused by: java.lang.SecurityException: Jurisdiction policy files are not signed by trusted signers!

at javax.crypto.e.a(Unknown Source)

at javax.crypto.e.a(Unknown Source)

at javax.crypto.e.g(Unknown Source)

at javax.crypto.f.run(Unknown Source)

at java.security.AccessController.doPrivileged1(Native Method)

at java.security.AccessController.doPrivileged(AccessController.java:351)

... 10 more
3

Subject: RE: Notes - Java and Bouncycastle

Check out the comment thread for a post on my blog (Java in Notes/Domino Explained: Security 101 – lekkimworld.com) where I think you’ll find the answers you are looking for.

/Mikkel Heisterberg

Visit my Notes/Domino blog @ http://lekkimworld.com

for posts on Notes/Domino and how to use Java in Notes/Domino…

4

Subject: RE: Notes - Java and Bouncycastle

Not seeing the solution there, here is what I think I am seeing.

  1. I am using an encryption algorithm that requires the unrestricted policy files

  2. If I install the sun unrestricted policy files, they are therefore signed by a different signer than the IBM JCE provider

  3. I need to use SUN JCE because the Notes 7 jvm doesnt seem to include PKCS12 as a keystore type. Which means I have to add Sun JCE, and I hit problem 2)

I have tried to add the Sun JCE provider but no matter where I put it in the list in java.security i get error.

Simon