RC4 and ECDHE_RSA

[Martin Haase]

Hi team,
This is IdP 2.4.0, Tomcat6.0.24, java-1.6.0-openjdk, RHEL6.4.
Trying to get metadata via a https URL, that server uses RC4_128
encryption and ECDHE_RSA for key exchange.

Starting up the IdP, it cannot fetch metadata:

javax.net.ssl.SSLException: java.lang.RuntimeException: Could not
generate DH keypair
...
Caused by: java.security.InvalidAlgorithmParameterException: Prime size
must be multiple of 64, and can only range from 512 to 1024 (inclusive)

Other https servers work, f.e. AES_256_CBC encryption using DHE_RSA key
exchange.

I tried several combinations of:

* adding
security.provider.9=org.bouncycastle.jce.provider.BouncyCastleProvider to
 $JAVA_HOME/lib/security/java.security

* adding disregardSslCertificate="true" to the MetadataProvider

* adding
sslImplementationName="org.bouncycastle.jce.provider.BouncyCastleProvider" 
to /etc/tomcat6/server.xml, in the relevant <Connector>

None worked. Any ideas (besides, well, asking the provider to switch to
plain http for the metadata location)?

Cheers,
Martin



-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-6
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2345 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20130821/c61c4196/attachment.bin