How to sign a custom JCE security provider

Question

Sun's PKCS11 JCE security provider is lacking some functionality we need.
So I wrote an enhanced version of it using the original sources.

Unfortunately the JCE infrastructure rejects the new provider
"JCE cannot authenticate the provider"
because it is not properly signed.

javax.crypto.JceSecurity.verifyProviderJar(...) throws.
(it calls javax.crypto.JarVerifier.verify())

Any suggestions how to sign the new provider to make it work with JCE?

Answer 1

You need at least to add the security provider to the /path/to/jre/lib/security/java.security properties file. For more details see http://java.sun.com/javase/6/docs/technotes/guides/security/overview/jsoverview.html.

Answer 2

The process is described in the document, "How to Implement a Provider."

It involves emailing Sun some information (including the CSR you generated for your signing key), then faxing a confirmation document. Getting your signed certificate back from Sun can take a week or more, so plan ahead. I'm not sure if recent layoffs at Sun may have impacted this turn-around time.

You only need to sign your provider if it provides services that are restricted by some (repressive) governments, like Cipher. I assume with the message you're getting, that you are trying to provide some of those services.

If you provide any of these services, there's no way around it: You need a code-signing certificate issued by Sun. (One from IBM might work too; if I recall correctly, their code-signing CA is supported, but I don't know anything about their issuing process.)

Answer 3

You have to sign the JAR with "JCE Code Signing CA". In all current Java distributions, only 2 CAs (Sun and IBM) are built-in (hard-coded) and there is no way to add your own. We tried to work with Sun to sign our provider and it's almost impossible. They wouldn't issue intermediate CA cert, which means you have to go through the trouble every time you make a change.

Why don't you just user your own library? You use standard API for interoperability between different JCEs. But that's not realistic for CryptoKi/SmartCard stuff right now, you almost always need to write some custom code to interact with vendor specific API. You can even make your code mimic JCE API to minimize code changes.