Locate, open and close the BCJSSE default key/trust stores inside AccessController.doPrivileged, so the FilePermission for the JRE's jssecacerts/cacerts is required of the provider rather than of every protection domain on the call stack.

Author: dghgit

docs/releasenotes.html

@@ -45,6 +45,7 @@ <h3>2.1.2 Defects Fixed</h3>
 <li>HQC (org.bouncycastle.pqc.crypto.hqc) leaked secret-derived data through two timing/cache side channels. Its GF(2^8) arithmetic (GF) was implemented with log/exp/inv/sqr lookup tables indexed by field elements, so which cache line was touched revealed the operand - the same weakness as an AES T-table implementation. Those tables are reached with secret inputs on both sides of the KEM: ReedSolomon.encode multiplies by coefficients derived from the secret message during encapsulation, and ReedSolomon.decode and FastFourierTransform operate on syndromes, error-locator coefficients and root sets derived from the secret error vector during decapsulation. Separately, the fixed-weight support sampler broke out of its duplicate-detection scan as soon as a collision was found, and stored each accepted position at the secret running index; it samples the secret key supports x and y during key generation and re-expands y from the long-term secret key seed on every decapsulation, where the same seed produces the same draw sequence every time, so any timing variation there is a fixed and repeatedly measurable function of the private key. GF is now table-free and branch-free (carryless multiply with a masked reduction, squaring by bit-spreading, inversion as a^254), and the sampler is branch-free within a batch of candidates: every candidate is examined even once enough positions have been accepted, the duplicate scan visits every slot with no early exit, and an accepted position is written by masking across all slots rather than by indexing with the running count. The sampler's output and its byte consumption from the SHAKE stream are unchanged, so generated keys, ciphertexts and shared secrets are identical and the known-answer vectors still hold; the number of candidate batches it squeezes remains data-dependent, which is inherent to the specified sampler and cannot be changed without diverging from its output. The sibling sampler used for the encapsulation error vectors was already branch-free and is unaffected. HQC is exposed through the lightweight API and the BCPQC provider; the BC provider registers only its key-info converters. Reported by the Robusta team.</li>
 <li>NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so the reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ(x, q) was x % q with a variable divisor, which no compiler can strength-reduce to a multiply the way it can a constant one, so it emitted a real division on every call - including on the decapsulation path, through rqToS3 and trinaryZqToZ3, where the dividend derives from the private key. It is now x &amp; (q - 1), matching the reference MODQ macro; that is exact because q is always a power of two (NTRUParameterSet.q() returns 1 &lt;&lt; logQ) and every call site passes a dividend already masked to 16 bits. Polynomial.mod3 (both the short and byte overloads) and NTRUSampling.mod3 used % 3 on the secret key polynomials f and g during key generation, on the message polynomials r and m during encapsulation, and on coefficients recovered during decapsulation; they now use the reference implementation's division-free fold-and-select, folding by 255, then 15, then 3 before a single masked conditional subtraction. All four sites produce byte-identical results to the previous code across their entire input domain, so keys, ciphertexts, shared secrets and the known-answer vectors are unchanged. Reported by the Robusta team.</li>
 <li>JcePBMac1CalculatorBuilder.build() took the PBKDF2 iterationCount out of an RFC 9579 PBMAC1Params directly, unlike every sibling PBE/PBMAC1 path in the tree (the legacy-PBE branch of JcePKCS12MacCalculatorBuilderProvider, the BC-lightweight BcPKCS12PBMAC1CalculatorBuilder/PKCS12PBEUtils path, PKCS12PBMAC1KeyStoreSpi, and PKCS12Util.calculatePBMAC1), all of which already bound the count before deriving a key. Since PKCS12PfxPdu.isMacValid dispatches an id-PBMAC1 MacData to this builder, and the MAC key must be derived before the MAC can be checked, a PKCS#12 file with an attacker-chosen iteration count (up to 2^31-1) pinned a CPU core running PBKDF2-HMAC for as long as the count demanded before the (unauthenticated) file was ever rejected - a pre-authentication CPU denial of service from a file a few hundred bytes long. The same gap was reachable via JcePBMac1CalculatorProviderBuilder for a PBMAC1-protected CMP PBMProtectedPKIMessage. The iteration count is now bounded by the existing org.bouncycastle.pbe.max_iteration_count property (Properties.PBE_MAX_ITERATION_COUNT, default 10,000,000), throwing OperatorCreationException when exceeded, matching the cap already applied on every sibling path.</li>
+<li>Locating the JRE's default trust store in BCJSSE was not done in a privileged block, so under a security manager the java.io.FilePermission for it was required of every protection domain on the call stack rather than of the provider alone. The read of the file was already privileged, but the java.io.File.exists() probes that find it - javax.net.ssl.trustStore, then ${java.home}/lib/security/jssecacerts, then cacerts - were not. In a container that grants the BC jars their own permissions while sandboxing application code, SSLContext.getDefault() (or SSLContext.getInstance("Default", "BCJSSE")) therefore failed with "Default SSL algorithm not found in JRE", caused by a KeyManagementException reporting access denied ("java.io.FilePermission" "...jssecacerts" "read"); wrapping the call in the application's own doPrivileged did not help, since the denied domain is on the stack either way, and because DefaultSSLContextSpi caches the outcome in a static holder the failure was permanent for the life of the JVM. The default key store path (javax.net.ssl.keyStore) had the same gap in ProvKeyManagerFactorySpi and additionally opened and closed its file unprivileged. Locating, opening and closing the default key and trust stores now all run inside AccessController.doPrivileged, so only the provider's own protection domain is consulted; behaviour without a security manager, and where the whole stack is trusted, is unchanged.</li>
 </ul>
 
 <h3>2.1.3 Additional Features and Functionality</h3>

tls/src/main/java/org/bouncycastle/jsse/provider/FileUtils.java

@@ -0,0 +1,75 @@
+package org.bouncycastle.jsse.provider;
+
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+/**
+ * Privileged file system access used when locating and reading the default key/trust stores.
+ * <p>
+ * Finding the JRE's default stores is work the provider does on its own behalf rather than on
+ * behalf of the caller, so each operation runs inside an
+ * {@link AccessController#doPrivileged(PrivilegedAction)} block. Without it, every protection
+ * domain on the call stack needs its own {@code java.io.FilePermission} for the JRE's
+ * {@code jssecacerts} / {@code cacerts} files before something as ordinary as
+ * {@code SSLContext.getDefault()} will work under a security manager.
+ */
+class FileUtils
+{
+    static boolean exists(final String path)
+    {
+        return AccessController.doPrivileged(new PrivilegedAction<Boolean>()
+        {
+            public Boolean run()
+            {
+                return Boolean.valueOf(new File(path).exists());
+            }
+        }).booleanValue();
+    }
+
+    static InputStream openBufferedInputStream(final String path)
+        throws Exception
+    {
+        try
+        {
+            return AccessController.doPrivileged(new PrivilegedExceptionAction<InputStream>()
+            {
+                public InputStream run()
+                    throws Exception
+                {
+                    return new BufferedInputStream(new FileInputStream(path));
+                }
+            });
+        }
+        catch (PrivilegedActionException e)
+        {
+            throw e.getException();
+        }
+    }
+
+    static void closeInputStream(final InputStream input)
+        throws Exception
+    {
+        try
+        {
+            AccessController.doPrivileged(new PrivilegedExceptionAction<Void>()
+            {
+                public Void run()
+                    throws Exception
+                {
+                    input.close();
+                    return null;
+                }
+            });
+        }
+        catch (PrivilegedActionException e)
+        {
+            throw e.getException();
+        }
+    }
+}

tls/src/main/java/org/bouncycastle/jsse/provider/ProvKeyManagerFactorySpi.java

@@ -1,8 +1,5 @@
 package org.bouncycastle.jsse.provider;
 
-import java.io.BufferedInputStream;
-import java.io.File;
-import java.io.FileInputStream;
 import java.io.InputStream;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyStore;
@@ -41,7 +38,7 @@ static KeyStoreConfig getDefaultKeyStore() throws Exception
         }
         else if (null != ksPathProp)
         {
-            if (new File(ksPathProp).exists())
+            if (FileUtils.exists(ksPathProp))
             {
                 ksPath = ksPathProp;
             }
@@ -65,7 +62,7 @@ else if (null != ksPathProp)
             else
             {
                 LOG.config("Initializing default key store from path: " + ksPath);
-                ksInput = new BufferedInputStream(new FileInputStream(ksPath));
+                ksInput = FileUtils.openBufferedInputStream(ksPath);
             }
 
             try
@@ -83,7 +80,7 @@ else if (null != ksPathProp)
         {
             if (null != ksInput)
             {
-                ksInput.close();
+                FileUtils.closeInputStream(ksInput);
             }
         }
 

tls/src/main/java/org/bouncycastle/jsse/provider/ProvTrustManagerFactorySpi.java

@@ -1,16 +1,11 @@
 package org.bouncycastle.jsse.provider;
 
-import java.io.BufferedInputStream;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.InputStream;
-import java.security.AccessController;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchProviderException;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.security.cert.CertPathParameters;
 import java.security.cert.Certificate;
 import java.security.cert.PKIXParameters;
@@ -55,7 +50,7 @@ static KeyStore getDefaultTrustStore() throws Exception
         }
         else if (null != tsPathProp)
         {
-            if (new File(tsPathProp).exists())
+            if (FileUtils.exists(tsPathProp))
             {
                 tsPath = tsPathProp;
             }
@@ -66,7 +61,7 @@ else if (null != tsPathProp)
             if (null != javaHome)
             {
                 String jsseCacertsPath = javaHome + "/lib/security/jssecacerts".replace("/", File.separator);
-                if (new File(jsseCacertsPath).exists())
+                if (FileUtils.exists(jsseCacertsPath))
                 {
                     if (defaultCacertsToJKS)
                     {
@@ -77,7 +72,7 @@ else if (null != tsPathProp)
                 else
                 {
                     String cacertsPath = javaHome + "/lib/security/cacerts".replace("/", File.separator);
-                    if (new File(cacertsPath).exists())
+                    if (FileUtils.exists(cacertsPath))
                     {
                         if (defaultCacertsToJKS)
                         {
@@ -107,7 +102,7 @@ else if (null != tsPathProp)
             else
             {
                 LOG.config("Initializing default trust store from path: " + tsPath);
-                tsInput = openTrustStoreInput(tsPath);
+                tsInput = FileUtils.openBufferedInputStream(tsPath);
             }
 
             try
@@ -125,7 +120,7 @@ else if (null != tsPathProp)
         {
             if (null != tsInput)
             {
-                closeTrustStoreInput(tsInput);
+                FileUtils.closeInputStream(tsInput);
             }
         }
 
@@ -230,47 +225,6 @@ private static void collectTrustAnchor(Set<TrustAnchor> trustAnchors, Certificat
         }
     }
 
-    private static InputStream openTrustStoreInput(final String tsPath)
-        throws Exception
-    {
-        try
-        {
-            return AccessController.doPrivileged(new PrivilegedExceptionAction<InputStream>()
-            {
-                public InputStream run()
-                    throws Exception
-                {
-                    return new BufferedInputStream(new FileInputStream(tsPath));
-                }
-            });
-        }
-        catch (PrivilegedActionException e)
-        {
-            throw e.getException();
-        }
-    }
-
-    private static void closeTrustStoreInput(final InputStream tsInput)
-        throws Exception
-    {
-        try
-        {
-            AccessController.doPrivileged(new PrivilegedExceptionAction<Void>()
-            {
-                public Void run()
-                    throws Exception
-                {
-                    tsInput.close();
-                    return null;
-                }
-            });
-        }
-        catch (PrivilegedActionException e)
-        {
-            throw e.getException();
-        }
-    }
-
     private static KeyStore createTrustStore(String defaultType)
         throws NoSuchProviderException, KeyStoreException
     {