IV70544: CIPHERSPI CALLED ENGINEUPDATE() WHICH IS NOT SUPPORTED FOR AES/GCM

APAR status

• Closed as program error.

Error description

• Error Message: engineUpdate not supported for AES/GCM; only
  engineDoFinal is supported
  .
  Stack Trace: at
  com.ibm.crypto.provider.AESGCMCipherInHardware.engineUpdate(Unkn
  own Source)at javax.crypto.CipherSpi.a(Unknown Source)at
  javax.crypto.CipherSpi.engineDoFinal(Unknown Source)at
  javax.crypto.Cipher.doFinal(Unknown Source)
  .
  

Local fix

• Use ByteBuffer which was backed by an accessible byte array.
  

Problem summary

• The problem happens when AES/GCM cipher doFinal(ByteBuffer,
  ByteBuffer) was used with large ByteBuffer which is not backed
  by an accessible byte array.
  

Problem conclusion

• A fix is made to JCE frameworkThe associated Hursley RTC Problem
  Report is 85846The associated Austin CMVC defect is 116422JVMs
  affected: Java 7.0, Java 727 and Java 8The fix was delivered for
  Java 7.0 SR9, Java 727 SR3 Java 8 SR1The affected jar is
  "ibmjcefw.jar".The build level of this jar for the affected
  releases is "20150302"
  .
  This APAR will be fixed in the following Java Releases:
   8 SR1 (8.0.1.0)
   7 R1 SR3 (7.1.3.0)
   7 SR9 (7.0.9.0)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the Service
  Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R270 PSY

     UP

• R260 PSY

     UP