java - nCipherKM测试安装时出现错误

Question

当我运行 java com.ncipher.provider.InstallationTest 来检查正确安装提供程序 nCipherKM 时发生错误。

> java com.ncipher.provider.InstallationTest
talled providers:
nCipherKM
SUN
SunRsaSign
SunEC
SunJSSE
SunJCE
SunJGSS
SunSASL
XMLDSig
 SunPCSC
 SunMSCAPI

Exception in thread "main" java.lang.ExceptionInInitializerError
        at javax.crypto.JceSecurity.loadPolicies(JceSecurity.java:378)
        at javax.crypto.JceSecurity.setupJurisdictionPolicies(JceSecurity.java:323)
        at javax.crypto.JceSecurity.access$000(JceSecurity.java:50)
        at javax.crypto.JceSecurity$1.run(JceSecurity.java:85)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.crypto.JceSecurity.<clinit>(JceSecurity.java:82)
        at javax.crypto.JceSecurityManager.<clinit>(JceSecurityManager.java:65)
        at javax.crypto.Cipher.getConfiguredPermission(Cipher.java:2586)
        at javax.crypto.Cipher.getMaxAllowedKeyLength(Cipher.java:2610)
        at com.ncipher.provider.InstallationTest.unlimitedStrengthJurisdictionPolicyFilesInstalled(InstallationTest.java:130)
        at com.ncipher.provider.InstallationTest.main(InstallationTest.java:70)
Caused by: java.lang.SecurityException: Framework jar verification can not be initialized
        at javax.crypto.JarVerifier.<clinit>(JarVerifier.java:228)
        ... 11 more
Caused by: com.ncipher.provider.nCCommunicationException: Error NoUsableModules while opening channel for MessageDigest mech 44 (SHA1Hash)
        at com.ncipher.provider.nCHash.openChannel(nCHash.java:208)
        at com.ncipher.provider.nCHash.updateChannel(nCHash.java:215)
        at com.ncipher.provider.nCHash.flush(nCHash.java:175)
        at com.ncipher.provider.nCHash.engineDigest(nCHash.java:91)
        at java.security.MessageDigest$Delegate.engineDigest(Unknown Source)
        at java.security.MessageDigest.digest(Unknown Source)
        at javax.crypto.JarVerifier.getSystemEntropy(JarVerifier.java:857)
        at javax.crypto.JarVerifier.testSignatures(JarVerifier.java:744)
        at javax.crypto.JarVerifier.access$400(JarVerifier.java:37)
        at javax.crypto.JarVerifier$1.run(JarVerifier.java:222)
        at javax.crypto.JarVerifier$1.run(JarVerifier.java:187)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.crypto.JarVerifier.<clinit>(JarVerifier.java:186)
        ... 11 more

我做什么:

1. 将 nCipherKM.jar 文件从/java/classes 复制到/jre/lib/ext。
2. 从 oracle 下载 Java 加密扩展 (JCE) 无限强度管辖策略文件，并将 local_policy.jar 和 US_export_policy.jar 复制到 у jre/lib/security

3. 首先添加到 jre/lib/security/java.security nCipherKM 提供程序:

   security.provider.1=com.ncipher.provider.km.mCipherKMsecurity.provider.2=sun.security.provider.Sunsecurity.provider.3=sun.security.rsa.SunRsaSign...

4. 运行:

   java com.ncipher.provider.InstallationTest

并出现错误。

Answer 1

问题是您的 HSM 不可用，这意味着它们不可访问、处于错误模式或处于其他不可用状态:

Caused by: com.ncipher.provider.nCCommunicationException: Error NoUsableModules while opening channel for MessageDigest mech 44 (SHA1Hash)

运行/opt/nfast/bin/enquiry 以了解模块的状态并进行相应修复。

您将 nCipherKM 作为列表中的第一个(正如手册中所说的那样)，这意味着您的 JVM 将使用它来执行所有加密操作，包括散列。