ECDHE cipher suites not supported on OpenJDK 8 installed on EC2 Linux machine

Solution 1:

So I'm running a similar setup, with an AWS box running openjdk-1.8.0.51. what solved it for me is to add bouncycastle as a provider like so:

• Add the bcprov-<verion>.jar to /usr/lib/jvm/jre/lib/ext

• Edit /usr/lib/jvm/jre/lib/security/java.security adding the following line to the list of providers:

  security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider
  

(I added it as the 6th entry but you can add higher in the order if you prefer)

Restarted my application and was able to use EC-based cipher suites such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.

Solution 2:

The root cause is that OpenJDK on CentOS/RHEL/Amazon Linux with OpenJDK on them simply do not ship with the required native libraries to support EC. The Unlimited Policy Files are a red herring, as are any attempts to un-disable various algorithms, etc. If the libraries aren't there, you can't use the features.

The accepted answer of "install Bouncy Castle" works because BC provides a pure-Java implementation of all the desired algorithms. Ideally, the JDK would provide native implementations which would yield higher performance.

It looks like OpenJDK on Amazon Linux will just have to wait. :(

Ref: http://armoredbarista.blogspot.de/2013/10/how-to-use-ecc-with-openjdk.html

Also: https://security.stackexchange.com/questions/117975/how-to-enable-ecdhe-in-openjdk-1-8-0-in-centos-6-7

UPDATE 2016-11-09

It seems that Oracle's Elliptic curve native library (libsunec.so) is licensed under the GPL. You can confirm this by going to Oracle's download page, clicking on Third Party Licenses, and checking the README for your version of Java.

This means that, if you can grab a copy of Oracle's JRE/JDK for the target platform and architecture, you can take the libsunec.so library from it and install it legally into the OpenJDK installation.

For me, that meant grabbing the file $JAVA_HOME/jre/lib/amd64/libsunec.so from an Oracle Java 8 JRE and dropping it into e.g. /usr/lib/jvm/jre-1.8.0/lib/amd64/. That is all that is required in order to enable Elliptic-Curve algorithms.

UPDATE 2018-03-08

Oracle Java 9 will include the "unlimited strength cryptography" libraries enabled by default, so that's nice. It looks like OpenJDK will still require you to set a system property to enable "unlimited strength cryptography".

Solution 3:

Try installing the JCE Unlimited Strength Jurisdiction Policy Files (these should help with your higher bit ciphers)

Also note, in the link you provided about java 8 cipher protocol support says

Cipher suites that use Elliptic Curve Cryptography (ECDSA, ECDH, ECDHE, ECDH_anon) require a JCE cryptographic provider ...

Did you install such a provider on your Java 8 VM?