jgroups-4.1.7.Final w/ FIPS - failed creating group key and initializing ciphers

[Addie Drake]

Hi,

We are using jgroups-4.1.7.Final.jar on a RHEL 8 system with FIPS enabled.

Using JDBC_PING works as expected with the proper ssl settings on the URL.

However, when starting up Tomcat, we are seeing the following error in the logs:

2023-10-04 13:53:45.146 ERROR [MergeTask-18,liferay-channel-control,ip-x-x-x-x-38711][ASYM_ENCRYPT:99]  ip-x-x-x-x-38711: failed creating group key and initializing ciphers

Looking at the 4.1.17.Final tag on Github, I see this error message appearing in the ASYM_ENCRYPT.java line 550 https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550

    protected void createNewKey(String message) {
        try {
            this.secret_key=createSecretKey();
            initSymCiphers(sym_algorithm, secret_key);
            log.debug("%s: created new group key (version: %s) %s", local_addr, Util.byteArrayToHexString(sym_version), message);
            cacheGroupKey(sym_version);
        }
        catch(Exception ex) {
            log.error("%s: failed creating group key and initializing ciphers", local_addr, ex);
        }
    }

So the section of my config xml that I believe is causing this error is:

    <ASYM_ENCRYPT encrypt_entire_message="true"
            sym_keylength="256"
            sym_algorithm="AES"
            asym_keylength="2048"
            asym_algorithm="RSA" />

But I'm not sure what the issue with this is.

Any recommendations on what we should be doing to either troubleshoot or fix this error?

(Attached my config xml below)

Thanks,

Addie

[bel...@mailbox.org]

The format of the error msg is wrong: can you add a %s to the end and re-run, so we know what the exception is? 

Alternatively, debug&breakpoint to see the exception. 

I'm AFK, but will create an issue tomorrow. 

Cheers

Bela Ban

--
You received this message because you are subscribed to the Google Groups "jgroups-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jgroups-dev...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com.

[Tristan Tarrant]

Hi Addie,

when FIPS is enabled, your choice of ciphers/algorithms is limited: you can't just specify AES or RSA, but you have to use one of the allowed algorithms (I don't have that list unfortunately).

Tristan

--

[Addie Drake]

Hi Bela Ban,

I was able to get a better log by rebuilding the source code with the modifications you mentioned for jgroups-4.1.7.Final.jar:

2023-10-04 17:03:58.182 ERROR [MergeTask-19,liferay-channel-control,ip-x-x-x-x-6408][ASYM_ENCRYPT:99]  ip-x-x-x-x-6408: failed creating group key and initializing ciphers java.lang.NullPointerException
2023-10-04 17:03:58.183 ERROR [MergeTask-19,liferay-channel-control,ip-x-x-x-x-6408][ASYM_ENCRYPT:104]  Stacktrace:
java.lang.NullPointerException
at java.security.MessageDigest.update(MessageDigest.java:338)
at java.security.MessageDigest.digest(MessageDigest.java:413)
at org.jgroups.protocols.Encrypt.initSymCiphers(Encrypt.java:242)
at org.jgroups.protocols.ASYM_ENCRYPT.createNewKey(ASYM_ENCRYPT.java:553)
at org.jgroups.protocols.ASYM_ENCRYPT.down(ASYM_ENCRYPT.java:120)
at org.jgroups.protocols.BARRIER.down(BARRIER.java:136)
at org.jgroups.protocols.pbcast.NAKACK2.down(NAKACK2.java:555)
at org.jgroups.protocols.UNICAST3.down(UNICAST3.java:595)
at org.jgroups.protocols.pbcast.STABLE.down(STABLE.java:349)
at org.jgroups.protocols.pbcast.Merger.sendMergeView(Merger.java:329)
at org.jgroups.protocols.pbcast.Merger$MergeTask._run(Merger.java:591)
at org.jgroups.protocols.pbcast.Merger$MergeTask.run(Merger.java:526)
at java.lang.Thread.run(Thread.java:750)

Thanks,

Addie

[Addie Drake]

Hi Tristan,

That's more or less what I am suspecting as well, but I also don't have that list and haven't been able to find reliable documentation. :\

Will keep looking and will update if I find anything that works.

Thanks,

Addie 

[Addie Drake]

Hi all,

I may have found where it's actually breaking after scouring the JGroups 4.1.7 source:

https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242

(highlighted below)

    /** Initialises the ciphers for both encryption and decryption using the generated or supplied secret key */
    protected void initSymCiphers(String algorithm, Key secret) throws Exception {
        if(secret == null)
            return;

        BlockingQueue<Cipher> tmp_encoding_ciphers=new ArrayBlockingQueue<>(cipher_pool_size);
        BlockingQueue<Cipher> tmp_decoding_ciphers=new ArrayBlockingQueue<>(cipher_pool_size);
        for(int i=0; i < cipher_pool_size; i++ ) {
            tmp_encoding_ciphers.offer(createCipher(algorithm));
            tmp_decoding_ciphers.offer(createCipher(algorithm));
        }

        // set the version
        MessageDigest digest=MessageDigest.getInstance("MD5");
        byte[] tmp_sym_version=digest.digest(secret.getEncoded());

        this.encoding_ciphers = tmp_encoding_ciphers;
        this.decoding_ciphers = tmp_decoding_ciphers;
        this.sym_version = tmp_sym_version;
    }

secret.getEncoded() is returning null which results in the NullPointerException in the stacktrace I sent previously.

Looking at docs for Key https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- , getEncoded is supposed to return "the encoded key, or null if the key does not support encoding."

I've included a basic Java program to illustrate the issue.

with fips enabled

# java test
SunPKCS11-NSS-FIPS version 1.8
AES
null
null

with fips disabled
# java -Dcom.redhat.fips=false test
SunJCE version 1.8
AES
RAW
[B@2c7b84de

I tried re-running this example with all available algorithms I could find (AES, DES, DESede, etc.), but same results for everything. So it seems using secret.getEncoded() with FIPS enabled is not possible, and thus using ASYM_ENCRYPT with FIPS enabled also does not seem possible (at least with JGroups 4.1.7).

Any other suggestions for setting up encryption with jgroups?

Thanks,

Addie

[Bela Ban]

https://issues.redhat.com/browse/JGRP-2734

> <mailto:jgroups-dev...@googlegroups.com>.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer>.

>
> --
> You received this message because you are subscribed to the Google
> Groups "jgroups-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jgroups-dev...@googlegroups.com

> <mailto:jgroups-dev...@googlegroups.com>.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/yfsc2i-pfglo3-oai8w0tkeaq3jgh25g-xqp8nxbb7cgy-px66og-mk0drp-z2f51n-t0ft2rl02lrc-3dmho0n3si6s-aea4so-qa9vt4-ni4qjn-jb9lc5w80aaj-gjq7b0o473e1-mohmqj-w5u92hy7nd45.1696434457170%40email.android.com <https://groups.google.com/d/msgid/jgroups-dev/yfsc2i-pfglo3-oai8w0tkeaq3jgh25g-xqp8nxbb7cgy-px66og-mk0drp-z2f51n-t0ft2rl02lrc-3dmho0n3si6s-aea4so-qa9vt4-ni4qjn-jb9lc5w80aaj-gjq7b0o473e1-mohmqj-w5u92hy7nd45.1696434457170%40email.android.com?utm_medium=email&utm_source=footer>.

--
Bela Ban | http://www.jgroups.org

[Bela Ban]

So I assume throwing the exception correctly (instead of an NPE) is the
solution here? So that people know that a given encryption alg is not
supported, and this is a configuration error?

On 05.10.23 00:33, Addie Drake wrote:
> Hi all,
>
> I may have found where it's actually breaking after scouring the JGroups
> 4.1.7 source:
>

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242>

>
> (highlighted below)
>
>     /** Initialises the ciphers for both encryption and decryption
> using the generated or supplied secret key */
>     protected void initSymCiphers(String algorithm, Key secret) throws
> Exception {
>         if(secret == null)
>             return;
>
>         BlockingQueue<Cipher> tmp_encoding_ciphers=new
> ArrayBlockingQueue<>(cipher_pool_size);
>         BlockingQueue<Cipher> tmp_decoding_ciphers=new
> ArrayBlockingQueue<>(cipher_pool_size);
>         for(int i=0; i < cipher_pool_size; i++ ) {
>             tmp_encoding_ciphers.offer(createCipher(algorithm));
>             tmp_decoding_ciphers.offer(createCipher(algorithm));
>         }
>
>         // set the version
>         MessageDigest digest=MessageDigest.getInstance("MD5");

> *        byte[] tmp_sym_version=digest.digest(secret.getEncoded());
> *

>         this.encoding_ciphers = tmp_encoding_ciphers;
>         this.decoding_ciphers = tmp_decoding_ciphers;
>         this.sym_version = tmp_sym_version;
>     }
>
> secret.getEncoded() is returning null which results in the
> NullPointerException in the stacktrace I sent previously.
>
> Looking at docs for Key

> https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded--> , getEncoded is supposed to return "the encoded key, or null if the key does not support encoding."

>
> I've included a basic Java program to illustrate the issue.
>

> *with fips enabled*

> # java test
> SunPKCS11-NSS-FIPS version 1.8
> AES
> null
> null
>

> *with fips disabled*

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550>

> https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer>.

>
> --
> You received this message because you are subscribed to the Google
> Groups "jgroups-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jgroups-dev...@googlegroups.com

> <mailto:jgroups-dev...@googlegroups.com>.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Addie Drake]

Not sure if my last message went through (I also may have clicked the wrong reply button) so just wanted to reiterate here.

Adding the stack trace to the log.error in createNewKey would help avoid confusion in the future, but to go farther, could also add a log error in initSymCiphers if secret.getEncoded() is null with a message like "secret key does not support encoding".

My solution to getting JGroups working on a RHEL 8 system with FIPS enabled:

1. Install bc-fips (https://www.bouncycastle.org/fips-java/) somewhere in the system classpath
2. Configure java.security and add the new BCFIPS provider. My fips.providers look like this:
   
   #
   # Security providers used when FIPS mode support is active
   #
   fips.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
   fips.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS
   fips.provider.3=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.fips.cfg
   fips.provider.4=sun.security.provider.Sun
   fips.provider.5=sun.security.ec.SunEC
   
3. Restart Tomcat

Running the test.java example I gave previously, this is the result:

with fips enabled, SunPKCS11-NSS-FIPS default provider

# java test
SunPKCS11-NSS-FIPS version 1.8
AES
null
null

with fips disabled, SunJCE default provider

# java -Dcom.redhat.fips=false test
SunJCE version 1.8
AES
RAW
[B@2c7b84de

with fips enabled, BCFIPS default provider

# java test

BCFIPS version 1.000204
AES
RAW
[B@5fa23c

Thanks again,

Addie

[Bela Ban]

I created an issue to show a better cause for the error:
https://issues.redhat.com/browse/JGRP-2735

On 11.10.23 23:04, Addie Drake wrote:
> Not sure if my last message went through (I also may have clicked the
> wrong reply button) so just wanted to reiterate here.
>
> Adding the stack trace to the log.error in createNewKey would help avoid
> confusion in the future, but to go farther, could also add a log error
> in initSymCiphers if secret.getEncoded() is null with a message like
> "secret key does not support encoding".
>
> My solution to getting JGroups working on a RHEL 8 system with FIPS enabled:
>

> 1. Install bc-fips (https://www.bouncycastle.org/fips-java/) somewhere
> in the system classpath
> 2. Configure java.security and add the new BCFIPS provider. My

> fips.providers look like this:
>
> #
> # Security providers used when FIPS mode support is active
> #
> fips.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> fips.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS
> fips.provider.3=sun.security.pkcs11.SunPKCS11
> ${java.home}/lib/security/nss.fips.cfg
> fips.provider.4=sun.security.provider.Sun
> fips.provider.5=sun.security.ec.SunEC

> 3. Restart Tomcat

>
> Running the test.java example I gave previously, this is the result:
>

> *with fips enabled, SunPKCS11-NSS-FIPS default provider*

> # java test
> SunPKCS11-NSS-FIPS version 1.8
> AES
> null
> null
>

> *with fips disabled, SunJCE default provider*

> # java -Dcom.redhat.fips=false test
> SunJCE version 1.8
> AES
> RAW
> [B@2c7b84de
>

> *with fips enabled, BCFIPS default provider*

> # java test
> BCFIPS version 1.000204
> AES
> RAW

> [B@5fa23c*
> *

>
> Thanks again,
> Addie
>
> On Monday, October 9, 2023 at 3:28:24 AM UTC-4 Bela Ban wrote:
>
> So I assume throwing the exception correctly (instead of an NPE) is the
> solution here? So that people know that a given encryption alg is not
> supported, and this is a configuration error?
>
> On 05.10.23 00:33, Addie Drake wrote:
> > Hi all,
> >
> > I may have found where it's actually breaking after scouring the
> JGroups
> > 4.1.7 source:
> >
> >

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242>>

> https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded--> <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-->> , getEncoded is supposed to return "the encoded key, or null if the key does not support encoding."

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550>>

> https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer>>.

> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "jgroups-dev" group.
> > To unsubscribe from this group and stop receiving emails from it,
> send
> > an email to jgroups-dev...@googlegroups.com
> > <mailto:jgroups-dev...@googlegroups.com>.
> > To view this discussion on the web visit
> >

> https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer>>.
>
> --
> Bela Ban | http://www.jgroups.org <http://www.jgroups.org>

>
> --
> You received this message because you are subscribed to the Google
> Groups "jgroups-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jgroups-dev...@googlegroups.com
> <mailto:jgroups-dev...@googlegroups.com>.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Bela Ban]

Hi Addie

I fixed this in [1] by throwing a better exception: I actually test
right at the start if the secret key supports encoding, and throw an
exception *right away* if it doesn't. I also allude to FIPS being
enabled in the error message as a possible cause.

Commits are on master, 5.2.x and 4.x branches.

Please let me know if this works for you,
Cheers

[1] https://issues.redhat.com/browse/JGRP-2734

On 11.10.23 23:04, Addie Drake wrote:

> Not sure if my last message went through (I also may have clicked the
> wrong reply button) so just wanted to reiterate here.
>
> Adding the stack trace to the log.error in createNewKey would help avoid
> confusion in the future, but to go farther, could also add a log error
> in initSymCiphers if secret.getEncoded() is null with a message like
> "secret key does not support encoding".
>
> My solution to getting JGroups working on a RHEL 8 system with FIPS enabled:
>

> 1. Install bc-fips (https://www.bouncycastle.org/fips-java/) somewhere
> in the system classpath
> 2. Configure java.security and add the new BCFIPS provider. My

> fips.providers look like this:
>
> #
> # Security providers used when FIPS mode support is active
> #
> fips.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> fips.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS
> fips.provider.3=sun.security.pkcs11.SunPKCS11
> ${java.home}/lib/security/nss.fips.cfg
> fips.provider.4=sun.security.provider.Sun
> fips.provider.5=sun.security.ec.SunEC

> 3. Restart Tomcat

>
> Running the test.java example I gave previously, this is the result:
>

> *with fips enabled, SunPKCS11-NSS-FIPS default provider*

> # java test
> SunPKCS11-NSS-FIPS version 1.8
> AES
> null
> null
>

> *with fips disabled, SunJCE default provider*

> # java -Dcom.redhat.fips=false test
> SunJCE version 1.8
> AES
> RAW
> [B@2c7b84de
>

> *with fips enabled, BCFIPS default provider*

> # java test
> BCFIPS version 1.000204
> AES
> RAW

> [B@5fa23c*
> *

>
> Thanks again,
> Addie
>
> On Monday, October 9, 2023 at 3:28:24 AM UTC-4 Bela Ban wrote:
>
> So I assume throwing the exception correctly (instead of an NPE) is the
> solution here? So that people know that a given encryption alg is not
> supported, and this is a configuration error?
>
> On 05.10.23 00:33, Addie Drake wrote:
> > Hi all,
> >
> > I may have found where it's actually breaking after scouring the
> JGroups
> > 4.1.7 source:
> >
> >

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242>>

> https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded--> <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-->> , getEncoded is supposed to return "the encoded key, or null if the key does not support encoding."

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550>>

> https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer>>.

> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "jgroups-dev" group.
> > To unsubscribe from this group and stop receiving emails from it,
> send
> > an email to jgroups-dev...@googlegroups.com
> > <mailto:jgroups-dev...@googlegroups.com>.
> > To view this discussion on the web visit
> >

> https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer>>.
>
> --
> Bela Ban | http://www.jgroups.org <http://www.jgroups.org>

>
> --
> You received this message because you are subscribed to the Google
> Groups "jgroups-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jgroups-dev...@googlegroups.com
> <mailto:jgroups-dev...@googlegroups.com>.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Addie Drake]

That looks great. Thanks so much, appreciate the fast turnaround!

- Addie

[Bela Ban]

No worries! I hope the change doesn't just look good, but actually
works! :-)

> <https://www.bouncycastle.org/fips-java/>) somewhere

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242>> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/Encrypt.java#L242>>>

> https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded--> <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-->> <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded--> <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-- <https://docs.oracle.com/javase/8/docs/api/java/security/Key.html#getEncoded-->>> , getEncoded is supposed to return "the encoded key, or null if the key does not support encoding."

> https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550>> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550> <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550 <https://github.com/belaban/JGroups/blob/JGroups-4.1.7.Final/src/org/jgroups/protocols/ASYM_ENCRYPT.java#L550>>>

> https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com>> <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer> <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/6aa736a9-9068-4d2b-a679-0e208ce4a3b2n%40googlegroups.com?utm_medium=email&utm_source=footer>>>.

> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "jgroups-dev" group.
> > > To unsubscribe from this group and stop receiving emails from it,
> > send
> > > an email to jgroups-dev...@googlegroups.com
> > > <mailto:jgroups-dev...@googlegroups.com>.
> > > To view this discussion on the web visit
> > >
> >

> https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com>> <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer> <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/b516830c-8d2d-4526-a220-2e424e080ecan%40googlegroups.com?utm_medium=email&utm_source=footer>>>.

> >
> > --
> > Bela Ban | http://www.jgroups.org <http://www.jgroups.org>
> <http://www.jgroups.org <http://www.jgroups.org>>
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "jgroups-dev" group.
> > To unsubscribe from this group and stop receiving emails from it,
> send
> > an email to jgroups-dev...@googlegroups.com
> > <mailto:jgroups-dev...@googlegroups.com>.
> > To view this discussion on the web visit
> >

> https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com> <https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/jgroups-dev/57a5a346-f2e3-43aa-a2c9-fd9ef460a6fen%40googlegroups.com?utm_medium=email&utm_source=footer>>.
>
> --

> Bela Ban | http://www.jgroups.org <http://www.jgroups.org>
>
> --
> You received this message because you are subscribed to the Google
> Groups "jgroups-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jgroups-dev...@googlegroups.com
> <mailto:jgroups-dev...@googlegroups.com>.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/jgroups-dev/0ec5c262-40dc-47e1-8919-acca81623e60n%40googlegroups.com <https://groups.google.com/d/msgid/jgroups-dev/0ec5c262-40dc-47e1-8919-acca81623e60n%40googlegroups.com?utm_medium=email&utm_source=footer>.