This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/WSS-734 in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 8491783e7ba0a8976e4c1e047a6c4aabf19c36dc Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Nov 3 07:05:25 2026 +0000 WSS-734 - Don't depend on SHA1PRNG for Jasypt salt and IV generation --- .../wss4j/common/crypto/JasyptPasswordEncryptor.java | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java index 557276ee0..1e3345315 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java @@ -20,6 +20,7 @@ package org.apache.wss4j.common.crypto; import java.io.IOException; +import java.security.SecureRandom; import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; @@ -102,12 +103,14 @@ public class JasyptPasswordEncryptor implements PasswordEncryptor { } private void configureGenerators(String algorithm) { - if (FIPSUtils.isFIPSEnabled()) { - passwordEncryptor.setSaltGenerator(new RandomSaltGenerator("PKCS11")); - passwordEncryptor.setIvGenerator(new RandomIvGenerator("PKCS11")); - } else if (requiresIv(algorithm)) { - // AES-based PBE algorithms need an explicit IV generator with Jasypt - passwordEncryptor.setIvGenerator(new RandomIvGenerator()); + boolean fipsEnabled = FIPSUtils.isFIPSEnabled(); + // Always pass a SecureRandom algorithm explicitly, as Jasypt otherwise falls back to + // "SHA1PRNG", which is not offered by every JVM (e.g. one configured for FIPS) + String randomAlgorithm = fipsEnabled ? "PKCS11" : new SecureRandom().getAlgorithm(); + passwordEncryptor.setSaltGenerator(new RandomSaltGenerator(randomAlgorithm)); + // AES-based PBE algorithms need an explicit IV generator with Jasypt + if (fipsEnabled || requiresIv(algorithm)) { + passwordEncryptor.setIvGenerator(new RandomIvGenerator(randomAlgorithm)); } }
