IdP 3.3.1 - mac check in GCM failed

[George Stoynev]

Hello,

just installed Shibboleth IdP 3.3.1 on RHEL7, Java 8 on our Production 
environment. The following errors are being recorded in the idp-warn.log:

2017-06-12 10:12:26,902 - ERROR 
[net.shibboleth.utilities.java.support.security.DataSealer:214] - 
Exception unwrapping data
org.bouncycastle.crypto.InvalidCipherTextException: mac check in GCM failed
         at org.bouncycastle.crypto.modes.GCMBlockCipher.doFinal(Unknown 
Source)
2017-06-12 10:12:26,904 - ERROR 
[org.opensaml.storage.impl.client.ClientStorageService:425] - 
StorageService shibboleth.ClientSessionStorageService: Exception 
unwrapping secured data
net.shibboleth.utilities.java.support.security.DataSealerException: 
Exception unwrapping data
         at 
net.shibboleth.utilities.java.support.security.DataSealer.unwrap(DataSealer.java:215)
Caused by: org.bouncycastle.crypto.InvalidCipherTextException: mac check 
in GCM failed
         at org.bouncycastle.crypto.modes.GCMBlockCipher.doFinal(Unknown 
Source)

This is similar to an older message here - 
http://shibboleth.1660669.n2.nabble.com/mac-check-in-GCM-failed-td7620157.html. 


So far, all services seem OK and nobody complains. I was just wondering 
what the source of this error might be and how to mitigate it if possible.

Thank you,

-- 
George