PH19449: IBMJCEHYBRID DOES NOT FAILOVER BECAUSE SIGNATURE EXCEEDS BLOCKSIZE OF 2048

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: IBMJCEHybridException: Object state does not permit
  failover.
  Exception#0
  com.ibm.crypto.hdwrCCA.provider.JCECCARuntimeException: Hardware
  error from call CSNDDSV returnCode 12 reasonCode 11060
  Stack Trace:
   at
  com.ibm.crypto.hdwrCCA.provider.Crypto.a(Crypto.java:166)
   at
  com.ibm.crypto.hdwrCCA.provider.Crypto.a(Crypto.java:84)
   at
  com.ibm.crypto.hdwrCCA.provider.F.engineVerify(F.java:16)
   at
  java.security.SignatureSpi.engineVerify(SignatureSpi.java:289)
   at
  java.security.Signature$Delegate.engineVerify(Signature.java:123
  7)
   at java.security.Signature.verify(Signature.java:710)
   at
  com.ibm.crypto.ibmjcehybrid.provider.HybridSignature.verify(Hybr
  idSignature.java:1934)
   at
  com.ibm.crypto.ibmjcehybrid.provider.HybridSignature.engineVerif
  y(HybridSignature.java:1881)
   at
  java.security.Signature$Delegate.engineVerify(Signature.java:123
  7)
   at java.security.Signature.verify(Signature.java:710)
   at com.ibm.jsse2.ad.b(ad.java:91)
  ...
  .
  Examination of the trace written to stderr when
  -Djava.security.auth.debug=ibmjcehybrid is specified during JVM
  startup, shows IBMJCECCA performing operations and then failing
  with "CSNDDSV returnCode 12 reasonCode 11060", triggering a
  failover attempt by IBMJCEHybrid. Trace entries previous to the
  failover attempt showed that data blocking had been turned off.
  FINER: Successful call to update(bytes,offset,len) in provider:
  IBMJCECCA
   Blocking is active. Data caching is limited. blocksize =
  2048. Bytes passed since last reset = 6397
  <OSB>5/14/19 11:45:22:949 GMT<CSB> 0005296a id=
  com.ibm.crypto.ibmjcehybrid.provider.HybridSignature 2
  update Successful call to update(bytes,offset,len) in provider:
  IBMJCECCA
   Blocking is active. Data caching is limited. blocksize =
  2048. Bytes passed since last reset = 6397
  <OSB>5/14/19 11:45:22:949 GMT<CSB> 0005296a id=
  com.ibm.ws.logging.internal.WsLogger R
  log May 14, 2019 11:45:22 AM
  com.ibm.crypto.ibmjcehybrid.provider.HybridSignature
  turn_off_data_blocking
  FINER: RETURN blockSize = 2048 blocking_limited = true
  <OSB>5/14/19 11:45:22:949 GMT<CSB> 0005296a id=
  com.ibm.crypto.ibmjcehybrid.provider.HybridSignature <
  turn_off_data_blocking RETURN blockSize = 2048 blocking_limited
  = true
  

Local fix

• Bring the card back online and re-run the operation.
  

Problem summary

• IBMJCEHybrid does not failover because Signature exceeds
  blocksize of 2048
  

Problem conclusion

• Block size has been increased to handle larger amount of data in
  the event of a failover.
  .
  This APAR will be fixed in the following Java Releases:
   8 SR6 FP25 (8.0.6.25)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels