0
$\begingroup$

Upgrade to BouncyCastle 1.76 causing "CMSException: exception unwrapping key: cannot initialise algorithm parameters: LunaIvParameters: Unsupported engineInit method" error in RSAES-OAEP decryption

I recently upgraded my project from BouncyCastle version 1.68 to 1.76, and I'm encountering an issue with RSAES-OAEP decryption. Whenever I attempt to decrypt data using the RSAES-OAEP algorithm, I receive the following error:

makefile Copy code org.bouncycastle.cms.CMSException: exception unwrapping key: cannot initialise algorithm parameters: LunaIvParameters: Unsupported engineInit method

This error occurs specifically in the decryption method, and it seems related to the upgrade in BouncyCastle versions.

I'm unsure why this error is occurring after the upgrade. Could anyone provide insights into what might be causing this issue and how to resolve it?

try {
    while (it.hasNext()) {
        try {
            RecipientInformation recipient = it.next();
            if (ui.getEncryptionType().equalsIgnoreCase("RSAOAEP")) {
                decryptedStream = recipient.getContentStream(new JceKeyTransEnvelopedRecipient(privateKey)
                        .setAlgorithmMapping(PKCSObjectIdentifiers.id_RSAES_OAEP,
                                "RSA/GCM/OAEPWithSHA256AndMGF1Padding")
                        .setProvider("LunaProvider")
                        .setContentProvider("BC")).getContentStream();
            }
            break;
        } catch (Exception e) {
            // Exception handling
        }
    }
    if (decryptedStream == null) {
        throw new Exception("Content Failed to decrypt with PrivateKey 1");
    }

Below is the used for encryption

public AlgorithmIdentifier rsaesOaepIdentifier() {
    AlgorithmIdentifier hash = new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256, DERNull.INSTANCE);
    AlgorithmIdentifier mask = new AlgorithmIdentifier(PKCSObjectIdentifiers.id_mgf1, hash);
    AlgorithmIdentifier pSource = new AlgorithmIdentifier(PKCSObjectIdentifiers.id_pSpecified, new DEROctetString(new byte[0]));
    return new AlgorithmIdentifier(PKCSObjectIdentifiers.id_RSAES_OAEP, new RSAESOAEPparams(hash, mask, pSource));
}
$\endgroup$
2
  • $\begingroup$ This is a cross-post from SE. Another reason fir closing it is it's off-topic, or close to it, because in general we don't tackle programming questions (see our charter). Unclear: why the tag AES? And is LunaProvider some PKCS#11 provider (in which case there's a tag for that), or some other stuff? Is it sold as compatible with this release of BC? Can you reproduce the problem in a simple context, unrelated to a "makefile"? $\endgroup$
    – fgrieu
    Commented Jul 9 at 18:10
  • $\begingroup$ Luna is a family of HSM's by Thales. $\endgroup$
    – Maarten Bodewes
    Commented Jul 11 at 1:00

0

Browse other questions tagged or ask your own question.