Bouncy Castle FIPS Issue

[Brent Putman]

For future reference, this is really more appropriate for the dev list.


On 5/17/21 1:16 PM, Scott Coldwell wrote:
> Hi,
>
> We have been using OpenSAML 4.0 (by way of pac4j) successfully with 
> bouncy castle's FIPS provider only (no other bc providers on the 
> classpath).


Well, it's technically not supported to just replace our dependencies 
like that.  If you can get it to work, that's fine, it's your 
business.  But if if breaks, you are largely going to be on your own...



> We recently tried to update pac4j to version 5 which updated OpenSAML 
> to 4.1.  OpenSAML 4.1 no longer seems to work with bc-fips. We get 
> class not found exceptions on startup.


That's probably because in 4.1 we introduced support for ECDH 
encryption.  That's fundamentally about key derivation.  That class 
org.bouncycastle.crypto.DerivationParameters is likely indirectly used 
by the new support.  I know nothing of bc-fips - I've literally never 
looked at it - so I don't know why it wouldn't have that class or in 
general how it differs from the standard BC Java library.  If bc-fips 
is not literally just a FIPS-compliant drop-in replacement for 
bcprov-jdk15on, then you may be out of luck.


> Any idea how we can make it work like it did with OpenSAML 4.0?
>

I don't off-hand have any idea.  I'm personally curious as to how/why 
bc-fips differs from the standard BC library, and I might have some 
time to look at that down the road (weeks/months). As a project we may 
want to formally evaluate that, at a minimum to confirm what does and 
doesn't work. Don't know that we've ever been asked about FIPS 
compliance for the Shib IdP.

But that doesn't mean there is any solution forthcoming from us anytime 
soon, if ever.  You should assume you have to solve this yourself, if 
it's solvable.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210517/779f7cf9/attachment.htm>