payload: {"action":"opened","issue":{"url":"https://api.github.com/repos/AdoptOpenJDK/IcedTea-Web/issues/365","repository_url":"https://api.github.com/repos/AdoptOpenJDK/IcedTea-Web","labels_url":"https://api.github.com/repos/AdoptOpenJDK/IcedTea-Web/issues/365/labels{/name}","comments_url":"https://api.github.com/repos/AdoptOpenJDK/IcedTea-Web/issues/365/comments","events_url":"https://api.github.com/repos/AdoptOpenJDK/IcedTea-Web/issues/365/events","html_url":"https://github.com/AdoptOpenJDK/IcedTea-Web/issues/365","id":480234607,"node_id":"MDU6SXNzdWU0ODAyMzQ2MDc=","number":365,"title":"Issue using security providers in OpenJDK","user":{"login":"alfabravoteam","id":6309365,"node_id":"MDQ6VXNlcjYzMDkzNjU=","avatar_url":"https://avatars0.githubusercontent.com/u/6309365?v=4","gravatar_id":"","url":"https://api.github.com/users/alfabravoteam","html_url":"https://github.com/alfabravoteam","followers_url":"https://api.github.com/users/alfabravoteam/followers","following_url":"https://api.github.com/users/alfabravoteam/following{/other_user}","gists_url":"https://api.github.com/users/alfabravoteam/gists{/gist_id}","starred_url":"https://api.github.com/users/alfabravoteam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alfabravoteam/subscriptions","organizations_url":"https://api.github.com/users/alfabravoteam/orgs","repos_url":"https://api.github.com/users/alfabravoteam/repos","events_url":"https://api.github.com/users/alfabravoteam/events{/privacy}","received_events_url":"https://api.github.com/users/alfabravoteam/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-08-13T15:51:58Z","updated_at":"2019-08-13T15:51:58Z","closed_at":null,"author_association":"NONE","body":"**Short version:**\r\n\r\nIs it expected to need to add policies to OpenJDK JRE `java.policy` in order to use JCE crypto library in a default OpenJDK8 installation? Is it some sort of bug or misconfiguration in the Windows versions of OpenJDK?? Sorry if this is not the right place to ask for this, dunno which project should get this one.\r\n\r\n**Long version:**\r\n\r\nI have this Swing app loaded thru WebStart which I'm trying to use with OpenJDK8 (either RedHat, AdoptOpenJDK or Coretto variants) + IcedTea WebStart (downloaded from [here][1]). Everything in my Swing app works but one panel.\r\n\r\nI get some encrypted text stored somewhere and I decrypt it to be presented in a TextField using the following method:\r\n\r\n    public synchronized static String decrypt(String toDecrypt, byte[] key) {\r\n        Key keySpec = new SecretKeySpec(key, \"AES\");\r\n        try {\r\n            CIPHER.init(Cipher.DECRYPT_MODE, keySpec);\r\n            return new String(CIPHER.doFinal(toBytes(toDecrypt)));\r\n        }\r\n        catch (Exception e) {\r\n            throw new RuntimeException(e);\r\n        }\r\n    }\r\n\r\nThe panel where this process is done decrypts on load and it fails to load in the IcedTea-web included in RedHat OpenJDK (v1.7 I think) with an error saying:\r\n\r\n     at javax.crypto.Cipher.getInstance(Cipher.java:539)  Caused by: java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES \r\n        ... 45 more \r\n        Caused by: java.lang.RuntimeException: java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES \r\n        at java.awt.EventDispatchThread.run(EventDispatchThread.java:82)\r\n\r\nI tried [the code in this SO answer][2] on Linux and Windows installations of OpenJDK and it says there's a difference in the providers available.\r\n\r\nFor Windows:\r\n\r\n* SunPCSC version 1.8 \r\n* XMLDSig version 1.8 \r\n* SunSASL version 1.8 \r\n* SunJGSS version 1.8 \r\n* SunJSSE version 1.8 \r\n* SunEC version 1.8 \r\n* SunRsaSign version 1.8 \r\n* SUN version 1.8\r\n\r\nFor linux:\r\n\r\n* SUN version 1.8\r\n* SunRsaSign version 1.8\r\n* SunEC version 1.8\r\n* SunJSSE version 1.8\r\n* ***SunJCE version 1.8***\r\n* SunJGSS version 1.8\r\n* SunSASL version 1.8\r\n* XMLDSig version 1.8\r\n* SunPCSC version 1.8\r\n\r\nSO, it seems to have the JCE missing.\r\n\r\nI tried up to the last IcedTeaWeb available (v1.8) and all of them have the full list of providers configured by default:\r\n\r\n    security.provider.1=sun.security.provider.Sun\r\n    security.provider.2=sun.security.rsa.SunRsaSign\r\n    security.provider.3=sun.security.ec.SunEC\r\n    security.provider.4=com.sun.net.ssl.internal.ssl.Provider\r\n    security.provider.5=com.sun.crypto.provider.SunJCE\r\n    security.provider.6=sun.security.jgss.SunProvider\r\n    security.provider.7=com.sun.security.sasl.Provider\r\n    security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI\r\n    security.provider.9=sun.security.smartcardio.SunPCSC\r\n    security.provider.10=sun.security.mscapi.SunMSCAPI\r\n\r\nAlso the security policy unlimited\r\n\r\n    # Note: This property is currently used by the JDK Reference implementation.\r\n    # It is not guaranteed to be examined and used by other implementations.\r\n    #\r\n    crypto.policy=unlimited\r\n\r\nBUT they seem to lack permissions for WebStart because I can decrypt and open the panel running the app from IntelliJ (no WebStart environment).\r\n\r\nFinally, only on the last IcedTea-WebStart version (v1.8) I got an additional error message while loading the panel:\r\n\r\n    Denying permission: (\"java.lang.RuntimePermission\" \"loadLibrary.sunmscapi\")\r\n    Denying permission: (\"java.security.SecurityPermission\" \"putProviderProperty.SunJCE\")\r\n\r\nIt led me to try and add permissions in `java.policy`\r\n\r\n    permission java.security.SecurityPermission \"putProviderProperty.SunJCE\";\r\n\tpermission java.lang.RuntimePermission \"accessClassInPackage.sun.security.internal.spec\";\r\n\tpermission java.lang.RuntimePermission \"accessClassInPackage.sun.security.rsa\";\r\n\tpermission java.lang.RuntimePermission \"accessClassInPackage.sun.security.internal.interfaces\";\r\n\tpermission java.lang.RuntimePermission \"accessClassInPackage.sun.security.util\";\r\n\r\nAnd this way, my app finally works at last. But, as this is not documented anywhere, is it right to configure it this way? Am I setting up an insecure configuration? Is this something that should be fixed in OpenJDK? Thanks.\r\n\r\n\r\n  [1]: http://icedtea.wildebeest.org/download/icedtea-web-binaries/1.8/windows/\r\n  [2]: https://stackoverflow.com/a/8543693/236345\r\n\r\n"}}
other: {"actor":{"display_login":"alfabravoteam"}}