Skip to content

Only run FIPSKeysImporterDSA on jdk17+ in FIPS#43

Merged
judovana merged 1 commit intorh-openjdk:mainfrom
zzambers:FIPSKeysImporterDSA-17
Feb 25, 2026
Merged

Only run FIPSKeysImporterDSA on jdk17+ in FIPS#43
judovana merged 1 commit intorh-openjdk:mainfrom
zzambers:FIPSKeysImporterDSA-17

Conversation

@zzambers
Copy link
Copy Markdown
Contributor

On older jdks FIPSKeysImporterDSA.java fails in FIPS.

Exception (jdk8):

Execution failed: `main' threw exception: java.security.ProviderException: Unknown mechanism: 20
  • thrown in P11Signature.java
  • mechanism 20 (dec) → 14 (hex) is CKM_DSA_SHA256
  • support for CKM_DSA_SHA256 in P11Signature class was only added as part of JDK-8242332 (jdk16+). This explains why test is ok on jdk17+.
  • unlikely to get fixed in older jdks (proably not worth the effort, as DSA is forbidden in newer FIPS version anyway)

This exludes FIPSKeysImporterDSA.java on jdk < 17 in fips.

@judovana judovana merged commit f8db151 into rh-openjdk:main Feb 25, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants