[SHIRO-736] DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.2, 1.5.0
• Fix Version/s: 1.5.1
• Component/s: Cryptography & Hashing
• Labels: default exceptions regression security
• Assignee: Unassigned
• Reporter: Benjamin Marwell
• Created: 14/Jan/20 14:50
• Updated: 30/Jan/20 20:02
• Resolved: 30/Jan/20 20:02

Description

Dear all,

Problem Description

the default cipher instance for the RememberMe Manager is set in the AbstractRememberMeManager's constructor:

AesCipherService cipherService = new AesCipherService();

Now, AesCipherService sets the Algorithm to AES and OperationMode to GCM in its constructor, but it inherits it's parents PaddingMode. Since the parent is "DefaultBlockCipherService" which is a block cipher service (as the name suggests), a padding is set and defaults to PKCS5.

This results in the method call javax.crypto.Cipher.getInstance( "AES/GCM/PKCS5Padding" ).  Most JVMs can handle this well and will use javax.crypto.Cipher.getInstance( "AES/GCM/NoPadding" ) internally, but some do not, because Padding with a streaming cipher does not seem specified.

 

Therefore, the default shiro setup will not work on such JVMs, which is a regression:

java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES/GCM/PKCS5Padding

 

Workarounds

Use this configuration in shiro.ini.

Note that you would not gain from security updates this way which is a big drawback!

cipherService = org.apache.shiro.crypto.AesCipherService
cipherService.paddingSchemeName = NoPadding
securityManager.rememberMeManager.cipherService = $cipherService 

 

Proposed Solution

In AesCipherService, add this line to the constructor:

setPaddingMode(PaddingMode.NONE.getTransformationName());

 

Affected Versions

I also added 1.5.0 as affected, becaue I guess it might not make it. Remove this version from the affected versions list if applicable.

Issue Links

• links to: GitHub Pull Request #194