java - BouncycaSTLeProvider 抛出 java.lang.NoSuchFieldError : id_hmacWithSHA3_224

Question

我正在学习 BouncycaSTLe 并面临一些问题。是否可以组合多个安全提供程序，例如我修改了我的 java.security 如下:

security.provider.11=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
security.provider.12=org.bouncycastle.jce.provider.BouncyCastleProvider 
security.provider.13=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider

然后在我的服务器端我写了:

...    
SSLContext sslContext = SSLContext.getInstance("TLS", "BCJSSE");
KeyManagerFactory keyMgrFact = KeyManagerFactory.getInstance(
                "PKIX", "BCJSSE");
keyMgrFact.init(Utils.createServerKeyStore(), Utils.SERVER_PASSWORD);
...

它会抛出一个错误:

public static KeyPair generateRootKeyPair()
            throws Exception {

        KeyFactory kFact = KeyFactory.getInstance("RSA", "BC");
        return new KeyPair(
                kFact.generatePublic(new X509EncodedKeySpec(rootPublicKey)),
                kFact.generatePrivate(new PKCS8EncodedKeySpec(rootPrivateKey)));
    }

错误信息:

Exception in thread "main" java.lang.NoSuchFieldError: id_hmacWithSHA3_224
    at org.bouncycastle.jcajce.provider.digest.SHA3$Mappings.configure(Unknown Source)
    at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(Unknown Source)
    at org.bouncycastle.jce.provider.BouncyCastleProvider.setup(Unknown Source)
    at org.bouncycastle.jce.provider.BouncyCastleProvider.access$000(Unknown Source)
    at org.bouncycastle.jce.provider.BouncyCastleProvider$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(Unknown Source)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.lang.Class.newInstance(Class.java:442)
    at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:221)
    at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:206)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:206)
    at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:187)
    at sun.security.jca.ProviderList.getProvider(ProviderList.java:233)
    at sun.security.jca.ProviderList.getIndex(ProviderList.java:263)
    at sun.security.jca.ProviderList.getProviderConfig(ProviderList.java:247)
    at sun.security.jca.ProviderList.getProvider(ProviderList.java:253)
    at sun.security.jca.GetInstance.getService(GetInstance.java:81)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:206)
    at java.security.KeyFactory.getInstance(KeyFactory.java:211)
    at Utils.generateRootKeyPair(Utils.java:103)
    at Utils.createRootCredential(Utils.java:199)
    at Utils.createServerKeyStore(Utils.java:273)
    at TLSServerExample.main(TLSServerExample.java:19)

我研究了几天，我认为这个问题的原因是包之间存在一些冲突:

bc-fips-1.0.0
bcprov-jdk15on-158.jar
bctls-fips-1.0.2.jar

如何解决？提前致谢!

Answer 1

主要是因为你的应用启动的时候，老版本的bouncy caSTLe类是按照java中的类加载顺序加载的。

您可以通过将 -verbose:class 添加到命令行来检查从哪个 jar 中加载充气城堡类，如 https://stackoverflow.com/a/6686792 中所述当你启动你的应用程序时。它会打印很多行，因此您必须搜索 bcp、com.bouncycaSTLe 等术语。

对我来说，这是因为 java lib 目录 (/path/to/java/jdk/jre/lib/ext/) 中存在与 bouncy caSTLe 相关的 jar。如果您使用的是 linux，请转到/path/to/java/jdk/jre/并在终端上运行以下命令。

find . -type f -name "*.jar*" | grep bcp

这将告诉我们充气城堡 jar 是否存在。如果存在，您将看到以下输出

./lib/ext/bcprov-jdk15on-1.50.jar

您可以升级它或删除它(如果它不影响您/同一盒子上的其他服务)