Hello,
I would like to report a SunPKCS11 bug affecting NSS versions with a minor
version of 128 or greater. The Java bug submission form returns “Access
Denied” when I try to report the same through there. Please could someone
help file a JBS issue?
The issue was reproduced on Linux x86_64 with upstream OpenJDK 25.0.2+10-69
and NSS 3.132.
(Disclaimer - first-time mailing list user, not too sure how to format code
blocks, etc.)
In `SunPKCS11.initToken()`, the NSS version check includes:
```
nssVersion.major == 3 && nssVersion.minor < 65
```
CK_VERSION.minor is a signed Java byte. For NSS 3.132, its value is
therefore -124. This incorrectly triggers the workaround that disables
RSA-PSS mechanisms for NSS versions older than 3.65.
Expected result:
NSS 3.132 should pass the version check, and SunPKCS11 should expose the
RSASSA-PSS signature algorithm.
Actual result:
```
NSS advertises RSA-PSS mechanisms, but SunPKCS11 disables them:
hardwareVersion: 3.132
...
Mechanism CKM_RSA_PKCS_PSS:
...
DISABLED due to known issue with NSS
...
Provider: SunPKCS11-NSSRepro
RSA-PSS service: null
Exception in thread "main" java.security.NoSuchAlgorithmException:
no such algorithm: RSASSA-PSS for provider SunPKCS11-NSSRepro
```
Steps to reproduce:
Save the following as NssPssRepro.java:
```
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.Provider;
import java.security.Security;
import java.security.Signature;
public class NssPssRepro {
public static void main(String[] args) throws Exception {
Path config = Files.createTempFile("nss-repro-", ".cfg");
try {
Files.writeString(config, """
name = NSSRepro
nssLibraryDirectory = %s
nssDbMode = noDb
nssModule = crypto
showInfo = true
""".formatted(args[0]));
Provider provider = Security.getProvider("SunPKCS11")
.configure(config.toString());
System.out.println("Provider: " + provider.getName());
System.out.println("RSA-PSS service: "
+ provider.getService("Signature", "RSASSA-PSS"));
Signature.getInstance("RSASSA-PSS", provider);
System.out.println("PASS: RSA-PSS is available");
} finally {
Files.deleteIfExists(config);
}
}
}
```
Save the following as Containerfile in the same directory:
```
FROM container-registry.oracle.com/java/openjdk:25 AS upstream
FROM docker.io/library/debian:bookworm-slim
RUN printf '%s\n' 'deb http://deb.debian.org/debian sid main' \
> /etc/apt/sources.list.d/nss-repro.list
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y -t sid \
--no-install-recommends libnss3 libstdc++6 zlib1g && \
rm -rf /var/lib/apt/lists/*
COPY --from=upstream /usr/java/jdk-25 /opt/jdk-25
ENV JAVA_HOME=/opt/jdk-25
ENV PATH=/opt/jdk-25/bin:$PATH
COPY NssPssRepro.java /repro/NssPssRepro.java
```
Build and run on Linux x86_64:
```
$ podman build -t localhost/nss-pss-repro -f Containerfile .
$ podman run --rm localhost/nss-pss-repro \
java -version
$ podman run --rm localhost/nss-pss-repro \
dpkg-query -W libnss3
$ podman run --rm localhost/nss-pss-repro \
java /repro/NssPssRepro.java /usr/lib/x86_64-linux-gnu
```
The container copies the unchanged JDK from Oracle’s upstream OpenJDK image
into a Debian environment with newer NSS. The tested versions were:
openjdk version "25.0.2" 2026-01-20
OpenJDK Runtime Environment (build 25.0.2+10-69)
OpenJDK 64-Bit Server VM (build 25.0.2+10-69, mixed mode, sharing)
libnss3:amd64 2:3.132-1
The final command fails with NoSuchAlgorithmException. It should print
PASS: RSA-PSS is available.
Thanks,
Robert
--
Robert Sturla
Senior Software Engineer
Red Hat <https://www.redhat.com>
[email protected]
<https://www.redhat.com>
