Reading encrypted private key in PKCS#8 format through bouncycastle, Java failing in docker container

Question

I am trying to read a PKCS#8 private key which looks like following:

key.k8 --> (Sample key. Passphrase - 123456):

Following code is being used to parse the private key:

 InputStream privateKeyInputStream = getPrivateKeyInputStream(); // reads the key file from classpath and share as DataStream
 logger.info("InputStreamExists --> {} ", privateKeyInputStream.available());
 PEMParser pemParser = new PEMParser(new InputStreamReader(privateKeyInputStream));
 Object pemObject = pemParser.readObject();
 if (pemObject instanceof PKCS8EncryptedPrivateKeyInfo) {
     // Handle the case where the private key is encrypted.
     PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pemObject;
     InputDecryptorProvider pkcs8Prov =
            new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passphrase.toCharArray());
     privateKeyInfo = encryptedPrivateKeyInfo.decryptPrivateKeyInfo(pkcs8Prov); // fails here
}

InputStream resourceAsStream = null;
    if ("local".equals(privateKeyMode)) {
      resourceAsStream = this.getClass().getResourceAsStream(privateKeyPath);
    } else {
      File keyFile = new File(privateKeyPath);
      logger.info(
          "Key file found in {} mode. FileName : {}, Exists : {}",
          privateKeyMode,
          keyFile.getName(),
          keyFile.exists());
      try {
        resourceAsStream = new DataInputStream(new FileInputStream(keyFile));
      } catch (FileNotFoundException e) {
        e.printStackTrace();
      }

When I am running this code through intelliJ on windows, the code works fine but when I run it through docker container I am getting following exception:

org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: failed to construct sequence from byte[]: Extra data detected in stream
snowflake-report-sync    |      at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source) ~[bcpkix-jdk15on-1.64.jar!/:1.64.00.0]
snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getPrivateKey(SnowFlakeConfig.java:103) ~[classes!/:na]
snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getConnectionProperties(SnowFlakeConfig.java:67) ~[classes!/:na]

Following is Dockerfile used:

FROM adoptopenjdk/openjdk11-openj9:latest
COPY build/libs/snowflake-report-sync-*.jar snowflake-report-sync.jar
RUN mkdir /encryption-keys
COPY encryption-keys/ /encryption-keys/ #keys are picked from docker filesystem when running in container
EXPOSE 8080
CMD java -Dcom.sun.management.jmxremote -noverify ${JAVA_OPTS} -jar snowflake-report-sync.jar

Options tried:

Ensured that key file is being read while running in container. Logger "InputStreamExists --> {}" gives number of bytes
Ran dos2unix on key.k8 just to make sure there are no Window's "^M" characters which be could be causing issue as container is linux one: FROM adoptopenjdk/openjdk11-openj9:latest

Not sure what I am doing wrong but any help or pointers would be appreciated.

Answer 1

Like @Bragolgirith suspected, BouncyCastle seems to have problems with OpenJ9. I guess it is not a Docker issue, because I can reproduce it on GitHub Actions, too. It is also not limited to BouncyCastle 1.64 or 1.70, it happens in both versions. It also happens on OpenJ9 JDK 11, 14, 17 on Windows, MacOS and Linux, but for the same matrix of Java and OS versions it works on Adopt-Hotspot and Zulu.

Here is an example Maven project and a failed matrix build . So if you select another JVM type, you should be fine. I know that @Bragolgirith already suggested that, but I wanted to make the problem reproducible for everyone and also provide an MCVE , in case someone wants to open a BC or OpenJ9 issue.

PS: It is also not a character set issue with the InputStreamReader . This build fails exactly the same as before after I changed the constructor call .

Update: I have created BC-Java issue #1099 . Let's see what the maintainers can say about this.

Answer 2

I've reproduced the issue and at this point I'd say it's an incompatibility issue with the OpenJ9 image/JVM.

Starting from any Hotspot base image instead, eg

FROM adoptopenjdk:11-jre-hotspot

makes the code work.

(Not yet entirely sure whether the fault lies with the Docker image itself, the OpenJ9 JVM or BouncyCastle)

Reading encrypted private key in PKCS#8 format through bouncycastle, Java failing in docker container

Question

2 answers

solution1
3 2022-01-29 12:01:53

solution2
2 2022-01-29 11:11:03

Reading encrypted private key in PKCS#8 format through bouncycastle, Java failing in docker container

Question

2 answers

solution1 3 2022-01-29 12:01:53

solution2 2 2022-01-29 11:11:03

solution1
3 2022-01-29 12:01:53

solution2
2 2022-01-29 11:11:03