Reduce the number of search terms.
Each term you use focuses the search further.
Check your spelling.
A single misspelled or incorrectly typed term can change your result.
Try substituting synonyms for your original terms.
For example, instead of searching for "java classes", try "java training"
Did you search for an IBM acquired or sold product ?
If so, follow the appropriate link below to find the content you need.
Subscribe to this APAR
By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.
Notify me when this APAR changes.
Notify me when an APAR for this component changes.
Error Message: javax.crypto.ShortBufferException: Output buffer
too short for GCM mode encryption because it must accommodate
padding characters and the Authentication Tag. 4096 bytes given,
4097 bytes needed.
javax.crypto.ShortBufferException: Output buffer too small
Stack Trace: IBMJCEHybridException: Failover exhausted, all
registered providers
attempted and failed.
Exception#0 javax.crypto.ShortBufferException: Output buffer too
short
for GCM mode encryption because it must accommodate padding
characters
and the Authentication Tag. 4096 bytes given, 4098 bytes needed.
Stack Trace:
com.ibm.crypto.hdwrCCA.provider.AESCipher.engineDoFinal(AESCiphe
r.java:1343)
at javax.crypto.Cipher.doFinal(Unknown Source)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:2921)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:3053)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:3053)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.engineDoFinal(
HybridCipher.java:2793)
at javax.crypto.CipherSpi.a(Unknown Source)
at javax.crypto.CipherSpi.engineDoFinal(Unknown Source)
at javax.crypto.Cipher.doFinal(Unknown Source)
at com.ibm.jsse2.n.a(n.java:358)
at com.ibm.jsse2.e.a(e.java:30)
at com.ibm.jsse2.e.a(e.java:55)
at com.ibm.jsse2.t.a(t.java:42)
at com.ibm.jsse2.aq.a(aq.java:488)
at com.ibm.jsse2.aq.c(aq.java:185)
at com.ibm.jsse2.aq.wrap(aq.java:101)
at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:33)
com.ibm.ws.channel.ssl.internal.SSLWriteServiceContext.encryptMe
ssage(SSLWriteServiceContext.java:640)
at java.lang.Thread.run(Thread.java:795)
Exception#1 javax.crypto.ShortBufferException: Output buffer too
small
Stack Trace:
at com.ibm.crypto.provider.aA.a(Unknown Source)
com.ibm.crypto.provider.AESGCMCipher.engineDoFinal(Unknown
Source)
at javax.crypto.Cipher.doFinal(Unknown Source)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:2921)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:3053)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:3053)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.doFinal(Hybrid
Cipher.java:3053)
com.ibm.crypto.ibmjcehybrid.provider.HybridCipher.engineDoFinal(
HybridCipher.java:2793)
at javax.crypto.CipherSpi.a(Unknown Source)
at javax.crypto.CipherSpi.engineDoFinal(Unknown Source)
at javax.crypto.Cipher.doFinal(Unknown Source)
.... (more details in messages.log file attached, reached RTC
description limit)
Local fix
Please add "GCM" to the
jdk.tls.disabledAlgorithms
property in the
<java home>/lib/security/java.security
file please.
Please Note that z/OSMF override the java.security file with
jvm.security.override.properties
in directory
/usr/lpp/zosmf/defaults/servers/zosmfServer
Other products may do something similar.
In this case the workaround will need to be applied to the
override.
Applying the workaround should result in the following or
similar (depending on any additional user changes) String:
(Note that the following 2 lines is a single line)
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize <
768, 3DES_EDE_CBC, DESede, EC keySize < 224, GCM
This will remove the GCM Cipher Suite.
The encryption, as a result of this change, will be only
marginally
weakened but still sufficiently strong.
An alternative workround is to disable the GCM Cipher in the
browser.
Problem summary
The framework (ibmjcefw) attempts to reuse the IBMJCEHybrid
Cipher object after the exception without reinitializing it,
which fails.
Problem conclusion
IBMJCEHybrid was modified so that when this exception was
received it would reset the cipher object.
For reference, the documentation
https://docs.oracle.com/javase/8/docs/api/javax/crypto/Cipher.ht
ml#doFinal(byte[], int, int, byte[]) does Note that this reset
might be necessary.
This APAR will be fixed in the following Java Releases:
8 SR5 FP10 (8.0.5.10)
7 SR10 FP20 (7.0.10.20)
7 R1 SR4 FP20 (7.1.4.20)
Contact your IBM Product's Service Team for these Service
Refreshes and Fix Packs.
For those running stand-alone, information about the available
Service Refreshes and Fix Packs can be found at:
https://www.ibm.com/developerworks/java/jdk/
Temporary fix
Comments
APAR Information
APAR number
PI93233
Reported component name
JAVA Z/OS 64
Reported component ID
620700104
Reported release
800
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2018-02-01
Closed date
2018-02-01
Last modified date
2018-07-03
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
