Kryo NullPointerException when loading class KeyPair variable with ALG_EC_FP keys

[dempa]

It looks like there is an issue when loading (deserializing) an installed applet with a KeyPair class variable that is initialized with ALG_EC_FP and has generated keys.

Using algorithm ALG_RSA does not trigger the crash.

public class OTPApplet extends Applet {
    private final KeyPair keyPair;
    OTPApplet(byte[] bArray, short bOffset, byte bLength) {
        //keyPair = new KeyPair(ALG_RSA, (short) 1024);  // works on both installation and on load
        keyPair = new KeyPair(ALG_EC_FP, (short) 256); // works on installation but crashes on load

        keyPair.genKeyPair(); // note: for the crash to occur the keys must be generated

The installation / instantiation of the applet works fine.
When the app is restarted it throws an exception in SimulatorRuntime::loadApplet()

Trying to load an instance of com.licel.globalplatform.GpSimulatorRuntime
Failed to load the instance! Will use the default SimulatorRuntime
com.licel.jcardsim.esotericsoftware.kryo.KryoException: java.lang.NullPointerException: Attempt to get length of null array
Serialization trace:
preCompTable (com.licel.jcardsim.bouncycastle.math.ec.ECPoint$Fp)
G (com.licel.jcardsim.bouncycastle.crypto.params.ECDomainParameters)
params (com.licel.jcardsim.bouncycastle.crypto.generators.ECKeyPairGenerator)
engine (com.licel.jcardsim.crypto.KeyPairImpl)
impl (javacard.security.KeyPair)
keyPair (com.licel.samples.applet.OTPApplet)

The issue was found when trying out the app https://github.com/licel/hotp-authenticator which is using jcardsim-3.0.5.jar

[agreenbhm]

I'm seeing this as well. Any workaround you found?

[dempa]

I'm seeing this as well. Any workaround you found?

I did something like this to avoid the issue:

public class TestApplet extends Applet {
    private final ECPublicKey publicKey;
    private final ECPrivateKey privateKey;

    TestApplet(byte[] bArray, short bOffset, byte bLength) {
        publicKey = (ECPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_EC_FP_PUBLIC, KeyBuilder.LENGTH_EC_FP_256, false);
        privateKey = (ECPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_EC_FP_PRIVATE, KeyBuilder.LENGTH_EC_FP_256, false);
        EC.setCurveParameters(publicKey);
        EC.setCurveParameters(privateKey);
    }

    private short someInitMethodCalledOnlyOnce() {
        KeyPair keyPair = new KeyPair(publicKey, privateKey);
        keyPair.genKeyPair();
    }
}

[agreenbhm]

privateKey = (ECPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_EC_FP_PRIVATE, KeyBuilder.LENGTH_EC_FP_256, false);

Thanks for the reply. Would you mind sharing an example of where you are calling that "someInitMethodCalledOnlyOnce" method? Struggling to find the right place to put it.