IBM WEME J9 Invalid Padding Exception

Question

I am using the IBM Websphere Everyplace Micro Environment JVM on a Windows Mobile 6 device. My application uses HTTPS connections and I have everything set up appropriately to use the J9JSSE package for SSL/TLS. Some messages that are being transmitted on the HTTPS connection are getting through just fine, but others are causing an exception on the client:

java.io.IOException: invalid padding
    at com.ibm.oti.crypto.Util.unpadTLS10(Unknown Source)
    at com.ibm.oti.crypto.CL3BasedProvider.decryptImpl(Unknown Source)
    at com.ibm.oti.crypto.CL3BasedProvider.cryptUpdate(Unknown Source)
    at com.ibm.oti.crypto.Key.cryptFinish(Unknown Source)
    at com.ibm.j9.ssl.CipherAlgorithm.decipher(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl.readData(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl$SSLInputStream.read(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl$SSLInputStream.read(Unknown Source)
    at java.io.BufferedInputStream.fillbuf(Unknown Source)
    at java.io.BufferedInputStream.read(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.readln(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.readServerResponse(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.sendRequest(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.doRequest(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.getInputStream(Unknown Source)

I have tried playing around with the Apache Tomcat server to confgure the cipher suite that is being used and the only one that will work is:

SSL_RSA_WITH_NULL_SHA

but this doesn't actually do any encryption (specified here by the null) so it is of no use to me. The default cipher suite that is used is:

SSL_RSA_WITH_3DES_EDE_CBC_SHA

And this along with all others that I have tried have this padding problem. Does anyone know what might be causing the problem and how I might solve it?

I found a single forum post where someone suggested that there was a bug in the J9 CBC implementation, but it seems strange that there is no other information on this anywhere online. Any help with this issue would be greatly appreciated.

Answer 1

Which JDK provider are you using for running Apache Tomcat server? If you are not using IBM JDK then you may want to try using that. This will ensure that cipher suite provider on both client and server is same (IBM).

http://www.ibm.com/developerworks/java/jdk/

Update: Can you use same JVM provider as Tomcat Server, for Windows Mobile 6? Which JDK provider are you using for running Apache Tomcat server?

Answer 2

The following Cipher Suites are supported by the J9 JSSE implementation: J9 JSSE and Provider Details

• SSL_RSA_WITH_3DES_EDE_CBC_SHA
• SSL_RSA_WITH_DES_CBC_SHA
• SSL_RSA_WITH_NULL_SHA
• SSL_RSA_WITH_NULL_MD5
• SSL_RSA_WITH_RC4_128_SHA
• SSL_RSA_WITH_RC4_128_MD5
• TLS_RSA_WITH_AES_128_CBC_SHA

.

User thirdparty Open SSL on tomcat

SSL or TLS cipher suites names from the relevant specification and their OpenSSL equivalents

SSL v3.0 cipher suites.

 SSL_RSA_WITH_3DES_EDE_CBC_SHA ----> DES-CBC3-SHA
 SSL_RSA_WITH_DES_CBC_SHA ---------> DES-CBC-SHA
 SSL_RSA_WITH_NULL_SHA ------------> NULL-SHA
 SSL_RSA_WITH_NULL_MD5 ------------> NULL-MD5
 SSL_RSA_WITH_RC4_128_SHA ---------> RC4-SHA
 SSL_RSA_WITH_RC4_128_MD5 ---------> RC4-MD5

AES ciphersuites from RFC3268, extending TLS v1.0

 TLS_RSA_WITH_AES_128_CBC_SHA -----> AES128-SHA

.

If possible, see if you can use Open SSL on IBM Websphere Everyplace Micro Environment JVM as well. If not then try using J9 JSSE on Tomcat.

Point here being to have server and client using same cipher suites.

Answer 3

So the ultimate answer I came to was to switch to a different JVM. Very little support available from IBM and just trying to get someone to sell us licences for their JVM was proving very difficult. I guess they only like to deal with huge organisations.

Now using CEE-J from Skelmir and so far it is a lot more promising.