(ws-wss4j) branch master updated: WSS-734 - Don't depend on SHA1PRNG for Jasypt salt and IV generation (#768)

[coheigea.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git


The following commit(s) were added to refs/heads/master by this push:
     new b9616ae7f WSS-734 - Don't depend on SHA1PRNG for Jasypt salt and IV 
generation (#768)
b9616ae7f is described below

commit b9616ae7f98814cc564f206b8c858d125476b2bb
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Tue Nov 3 07:15:31 2026 +0000

    WSS-734 - Don't depend on SHA1PRNG for Jasypt salt and IV generation (#768)
---
 .../wss4j/common/crypto/JasyptPasswordEncryptor.java      | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git 
a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java
 
b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java
index 557276ee0..1e3345315 100644
--- 
a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java
+++ 
b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/JasyptPasswordEncryptor.java
@@ -20,6 +20,7 @@
 package org.apache.wss4j.common.crypto;
 
 import java.io.IOException;
+import java.security.SecureRandom;
 
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
@@ -102,12 +103,14 @@ public class JasyptPasswordEncryptor implements 
PasswordEncryptor {
     }
 
     private void configureGenerators(String algorithm) {
-        if (FIPSUtils.isFIPSEnabled()) {
-            passwordEncryptor.setSaltGenerator(new 
RandomSaltGenerator("PKCS11"));
-            passwordEncryptor.setIvGenerator(new RandomIvGenerator("PKCS11"));
-        } else if (requiresIv(algorithm)) {
-            // AES-based PBE algorithms need an explicit IV generator with 
Jasypt
-            passwordEncryptor.setIvGenerator(new RandomIvGenerator());
+        boolean fipsEnabled = FIPSUtils.isFIPSEnabled();
+        // Always pass a SecureRandom algorithm explicitly, as Jasypt 
otherwise falls back to
+        // "SHA1PRNG", which is not offered by every JVM (e.g. one configured 
for FIPS)
+        String randomAlgorithm = fipsEnabled ? "PKCS11" : new 
SecureRandom().getAlgorithm();
+        passwordEncryptor.setSaltGenerator(new 
RandomSaltGenerator(randomAlgorithm));
+        // AES-based PBE algorithms need an explicit IV generator with Jasypt
+        if (fipsEnabled || requiresIv(algorithm)) {
+            passwordEncryptor.setIvGenerator(new 
RandomIvGenerator(randomAlgorithm));
         }
     }