Bad Padding Exception - RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING in pkcs11

[Manish Sahni]

I have developed an application and using the following keys for digital signatures those of which were placed in a file path (Directory) in testing environment.

1) XXX.p12 file - for Digital signature.

2) XXX.p12 file - for decryption of XML response.

3) XXX.cer file - for encrypting the session keys , input XML etc.

Since the files are on a particular file path location , the code is running fine.So for in the pre-production environment we have procured the CryptoGraphic Token from a CA and imported the XXX.p12 file for testing of the same, i am successfully able to digitally sign the request , However in case of decrypting the session key that is encrypted by the server using "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" i am getting the error as :-

javax.crypto.BadPaddingException: doFinal() failed
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:328)
	at sun.security.pkcs11.P11RSACipher.engineDoFinal(P11RSACipher.java:353)
	at javax.crypto.Cipher.doFinal(DashoA13*..)


Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ENCRYPTED_DATA_INVALID
	at sun.security.pkcs11.wrapper.PKCS11.C_Decrypt(Native Method)
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:306)
	... 5 more
15:43:07.709 [main] ERROR main.USBToken - javax.crypto.BadPaddingException: doFinal() failed
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:328)
	at sun.security.pkcs11.P11RSACipher.engineDoFinal(P11RSACipher.java:353)
	at javax.crypto.Cipher.doFinal(DashoA13*..)

My Testing Method is :-

private void testEncryption(byte[] plainText, PrivateKey privateKey, PublicKey publicKey) throws GeneralSecurityException {

	    System.out.println("Plain text: " + DatatypeConverter.printHexBinary(plainText));

	    Provider bcProvider = new BouncyCastleProvider();
	    Cipher rsaCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", bcProvider);
	    rsaCipher.init(Cipher.ENCRYPT_MODE, publicKey);
	    byte[] cipherText = rsaCipher.doFinal(plainText);

	    System.out.println("Cipher text: " + DatatypeConverter.printHexBinary(cipherText));

	   // Provider pkcs11provider = new SunPKCS11("C:\\Users\\manishs525\\pkcs11.cfg");
	    Cipher rsaCipher2 = Cipher.getInstance("RSA/ECB/PKCS1Padding", pkcs11Provider);
	    rsaCipher2.init(Cipher.DECRYPT_MODE, privateKey);
	    byte[] plainTextOAEPPadded = rsaCipher2.doFinal(cipherText);
	    
	    
	    System.out.println("OAEP padded plain text: " + DatatypeConverter.printHexBinary(plainTextOAEPPadded));
	    System.out.println("Actual text is "+new String(plainTextOAEPPadded));
	}

I have found the issue is that the implementation of SunJCE's Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" is not compatible with other implementations (BouncyCastle/IAIK/PKCS11)

When setting AlgorithmParameters (with OAEPParameterSpec) an exception is thrown (javax.crypto.BadPaddingException)

Refer : Problems with Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" Bug Details: https://bugs.openjdk.java.net/browse/JDK-7038158?page=com.atlassian.jira.plugin.system.issuetabpanels%3aworklog-tabpanel

Is their any way that i can decrypt the data for RSA-OAEP padding.

[Richard Tookey]

I have read your post several times and I'm thoroughly confused; what am I missing? I don't see how the testEncryption() method which uses "RSA/ECB/PKCS1Padding" has anything to do with "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" . Can you explain how the testEncryption() method relates to the problem you have?

[Manish Sahni]

Sorry for the wrong version.Updated with Correct version as follows :-

Manish Sahni wrote: I have developed an application and using the following keys for digital signatures those of which were placed in a file path (Directory) in testing environment.

1) XXX.p12 file - for Digital signature.

2) XXX.p12 file - for decryption of XML response.

3) XXX.cer file - for encrypting the session keys , input XML etc.

Since the files are on a particular file path location , the code is running fine.So for in the pre-production environment we have procured the CryptoGraphic Token from a CA and imported the XXX.p12 file for testing of the same, i am successfully able to digitally sign the request , However in case of decrypting the session key that is encrypted by the server using "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" i am getting the error as :-

javax.crypto.BadPaddingException: doFinal() failed
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:328)
	at sun.security.pkcs11.P11RSACipher.engineDoFinal(P11RSACipher.java:353)
	at javax.crypto.Cipher.doFinal(DashoA13*..)


Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ENCRYPTED_DATA_INVALID
	at sun.security.pkcs11.wrapper.PKCS11.C_Decrypt(Native Method)
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:306)
	... 5 more
15:43:07.709 [main] ERROR main.USBToken - javax.crypto.BadPaddingException: doFinal() failed
	at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:328)
	at sun.security.pkcs11.P11RSACipher.engineDoFinal(P11RSACipher.java:353)
	at javax.crypto.Cipher.doFinal(DashoA13*..)

My Testing Method is :-

private void testEncryption(byte[] plainText, PrivateKey privateKey, PublicKey publicKey) throws GeneralSecurityException {

	    System.out.println("Plain text: " + DatatypeConverter.printHexBinary(plainText));

	    Provider bcProvider = new BouncyCastleProvider();
	    Cipher rsaCipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING", bcProvider);
	    rsaCipher.init(Cipher.ENCRYPT_MODE, publicKey);
	    byte[] cipherText = rsaCipher.doFinal(plainText);

	    System.out.println("Cipher text: " + DatatypeConverter.printHexBinary(cipherText));

	   // Provider pkcs11provider = new SunPKCS11("C:\\Users\\manishs525\\pkcs11.cfg");
	    Cipher rsaCipher2 = Cipher.getInstance("RSA/ECB/PKCS1Padding", pkcs11Provider);
	    rsaCipher2.init(Cipher.DECRYPT_MODE, privateKey);
	    byte[] plainTextOAEPPadded = rsaCipher2.doFinal(cipherText);
	    
	    
	    System.out.println("OAEP padded plain text: " + DatatypeConverter.printHexBinary(plainTextOAEPPadded));
	    System.out.println("Actual text is "+new String(plainTextOAEPPadded));
	}

I have found the issue is that the implementation of SunJCE's Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" is not compatible with other implementations (BouncyCastle/IAIK/PKCS11)

When setting AlgorithmParameters (with OAEPParameterSpec) an exception is thrown (javax.crypto.BadPaddingException)

Refer : Problems with Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" Bug Details: https://bugs.openjdk.java.net/browse/JDK-7038158?page=com.atlassian.jira.plugin.system.issuetabpanels%3aworklog-tabpanel

Is their any way that i can decrypt the data for RSA-OAEP padding.

[Richard Tookey]

Once again I don't understand! You encrypt using "OAEPWITHSHA-256ANDMGF1PADDING" and then decrypt using "PKCS1Padding" and wonder why you get a javax.crypto.BadPaddingException ! Also, you say the problem is due to SunJCE's Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" but you are using bcProvider which presumably means BouncyCastle!

These inconsistencies make it difficult for anyone to take your problem seriously!

P.S. Did you look at the end of the bug report for a suggested way round the SunJCE provider bug?

[Manish Sahni]

whether the encryption Scheme is using SunJCE or BC for RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING transformation , my requirement is to decrypt the response coming from the server and that too by accessing the key stored in the Hard token.
Since i am using SunPKCS11 Provider, it does not provide the support for decrypting OAEP padding coming from the server end, hence i need to know is it possible that i can decrypt the response with such a Transformation in SunPKCS11.


Thanks

Richard Tookey wrote:Once again I don't understand! You encrypt using "OAEPWITHSHA-256ANDMGF1PADDING" and then decrypt using "PKCS1Padding" and wonder why you get a javax.crypto.BadPaddingException ! Also, you say the problem is due to SunJCE's Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" but you are using bcProvider which presumably means BouncyCastle!

These inconsistencies make it difficult for anyone to take your problem seriously!

P.S. Did you look at the end of the bug report for a suggested way round the SunJCE provider bug?

[Richard Tookey]

The BUG report you cited refers to the SunJCE provider and not the SunPKCS11 provider but since it is possible that the padding code it common to both then the BUG may be applicable. If you read to the end of the BUG report then you will see that a suggested work around for dealing with the BUG is to decrypt with no padding and write code to remove the MGF1 padding. The specification for MGF1 padding is available in rfc2437 which Google will find. As an alternative to coding MGF1 from scratch you could look at the Bouncy Castle source and extract the bits you need.

[Manish Sahni]

Thanks for your response BTW , SunPKCS11 does not support NoPadding in version less than JDK 7 and only JDK 7 32 bit JRE (Windows Environment) and 32/64 Bit JDK 7 for Linux Environment.

For such a Transformation , OAEP padding removal becomes a mandate , i also do think that i need to remove it manually in the code itself after decryption.

RSAPadding.unpad might do the trick.

Thanks

Richard Tookey wrote:The BUG report you cited refers to the SunJCE provider and not the SunPKCS11 provider but since it is possible that the padding code it common to both then the BUG may be applicable. If you read to the end of the BUG report then you will see that a suggested work around for dealing with the BUG is to decrypt with no padding and write code to remove the MGF1 padding. The specification for MGF1 padding is available in rfc2437 which Google will find. As an alternative to coding MGF1 from scratch you could look at the Bouncy Castle source and extract the bits you need.