When using BC FIPS and EC certificates the PublicKey in PublicKeyAuthenticator is not correct

[RobChrystie]

Version

2.16.0

Bug description

I have a simple SshServer and SshClient that use EC P12s for connection. When I do not include BC FIPS, the server and client work with these certificates. When I use BC FIPS, the PublicKey I am getting from the PublicKeyAuthenticator callback getEncoded is wildly incorrect. Its about 3 times the size it should be. One oddity is it has several forward slashes in it. For reference these are EC secp521 P12s.

I'm at a loss trying to figure out why these are so different.

This is my first time entering a bug so I'm not sure what else to add to the issue. I can provide code snippets or whatever is needed.

I have tried several version of BC FIPS. Nothing in the debug logs stands out.

Actual behavior

Output with BC FIPS:

Incoming key: MIICRjCCAbkGByqGSM49AgEwggGsAgEBME0GByqGSM49AQECQgH//////////////////////////////////////////////////////////////////////////////////////zCBiARCAf/////////////////////////////////////////////////////////////////////////////////////8BEIAUZU+uWGOHJofkpohoLaFQO6i2nJbmbMV87i0iZGO8QnhVhk5Uex+k3sWUsC9O7G/BzVz34g9LDTx70Uf1GtQPwAEgYUEAMaFjga3BATpzZ4+y2YjlbRCnGSBOQU/tSH4KK9ga009uqFLXnfv51ko/h3BJ6L/qN4zSLPBhWpCm/l+fjHC5b1mARg5KWp4mjvABFyKX7QsfRvZmPVESVebRGgXr70XJz5mLJfucple9CZAxVC5AT+tB2E1PHCGonLCQIi+lHaf0WZQAkIB///////////////////////////////////////////6UYaHg78vlmt/zAFI9wml0Du1ybiJnEeuu2+3HpE4ZAkCAQEDgYYABAF/zUj6C5ZmfvPaogIyQNkCgMFZ7X8Xf31JyXFOChwP85QryiGTFjnIG3gWtYaFC3u8gRCFn2ldhAtpbYVKm+fCGAEacXYp4CPbeA+9xswDZxvZslqLMUHqOV5jlEmyq4TxnqQLHBPZ7RkmHxAhjgfjirRRPdYu6cmKesk+SRIk3jEdXA==

Expected behavior

Output without BC FIPS:

Incoming key: MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBf81I+guWZn7z2qICMkDZAoDBWe1/F399SclxTgocD/OUK8ohkxY5yBt4FrWGhQt7vIEQhZ9pXYQLaW2FSpvnwhgBGnF2KeAj23gPvcbMA2cb2bJaizFB6jleY5RJsquE8Z6kCxwT2e0ZJh8QIY4H44q0UT3WLunJinrJPkkSJN4xHVw=

Relevant log output

Other information

No response

[tomaswolf]

Please provide a sample key/certificate and a little sample Java maven project with all dependencies that tries to use that key/certificate. Then maybe I can debug to figure out what's going on.

[RobChrystie]

Thank you for the quick response!

Here is a link to the working demo not using BC FIPS:
https://github.com/RobChrystie/apache-mina-sshd

Here is the branch that implements BC FIP and is no longer working, showing the behavior described above:
https://github.com/RobChrystie/apache-mina-sshd/tree/implement-bc-fips

[tomaswolf]

Thanks a lot. I'll give this try, but I don't know when. Might be only next week.

After a quick look I have the impression you only include bc-fips:2.1.2 in your application. The Bouncy Castle documentation points out (click on the "BC-FJA 2.1.0/2.1.2" item) that you should also include bcutil-fips:2.1.5, and I'd also suggest including bcpkix-fips:2.1.10.

[RobChrystie]

I just tried adding them and the issue is still present. I pushed up the pom changes to my BC FIPS branch.

[tomaswolf]

1. The problem is not BC-FIPS specific, it also occurs with normal BC.
2. From the KeyStore, your code gets a key generated by SunEC, not by Bouncy Castle. SunEC encodes the key's algorithm ID as OID 1.2.840.10045.2.1 ("EC public key") with parameters OID 1.3.132.0.35 ("secp521r1"). When that key is read back from the network buffer by Bouncy Castle, it is reconstructed correctly , but is then a BCECPublicKey. This BCECPublicKey is encoded by writing the algorithm ID as OID 1.2.840.10045.2.1 ("EC public key") followed not by the curve OID but by the curve parameters. This explains the different X.509 encodings.
3. Using allowedKey.equals(incomingKey); may return false if comparing a SunEC key against a BC key. Maybe use KeyUtils.compare() instead. (Not sure it'll help.)
4. If you intend to use BC-FIPS, you probably also want the KeyStore to use BC-FIPS.
5. Didn't have the time to investigate further.

[tomaswolf]

Actually: it all works perfectly once you replace in the server allowedKey.equals(incomingKey); by KeyUtils.compareKeys(incomingKey, allowedKey);.

But you probably still want to use a BC KeyStore. Use KeyStore.getInstance("PKCS12", "BCFIPS");.

[tomaswolf]

I think I've found a way to teach Bouncy Castle to generate the X.509 encoding with the curve OID. I'll have to test a bit more, but if that works with or without BC, we'll correct that for 2.17.0.

[RobChrystie]

Thanks for all the help! Adding KeyUtils.compareKeys() did the trick. Looking forward to your test results. I'm all set on my end.

[RobChrystie]

One last question, would there be any way to convert the BCECPublicKey to the Java PublicKey to get the same result from getEncoding?

[RobChrystie]

I figured it out. I had to reconstruct the KeyPair and I got the output I wanted.