aws-samples / aws-samples/aws-cloudhsm-jce-examples

Cloudhsm sdk version 5.9 JCE not support ECDH for generate secret ver 3.4 is support using BouncyCastleProvider

Open
#74 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
46
Forks
70
Avg merge
52m
Merged PRs (30d)
4

Description

Hi, using KeyAgreement for ECDH is fail for generate secret

• KeyAgreement ecdh = KeyAgreement.getInstance("ECDH", CloudHsmProvider.PROVIDER_NAME);
• KeyAttributesMap params = new KeyAttributesMap();
• params.put(KeyAttribute.SIZE, 256);
• ecdh.init(, params);

SecretKey aesKey = ecdh.generateSecret("AES");

in the code using

Security.addProvider(new BouncyCastleProvider());
AuthProvider provider;
try {
provider = (AuthProvider) Security.getProvider(CloudHsmProvider.PROVIDER_NAME);
if (provider == null) {
provider = new CloudHsmProvider();
}
Security.addProvider(provider);
} catch (IOException | ProviderInitializationException | LoginException ex) {
System.out.println(ex);
return;
}

Contributor guide

Open the contributing guide

Research direction

Start with the ECDH KeyAgreement snippet in issue #74 and reproduce it using CloudHsmProvider with SDK 5.9, recording the exact exception and provider configuration. Compare the behavior with the shown BouncyCastleProvider setup; done means the failure and supported ECDH generateSecret behavior are clearly identified and documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.