SunPKCS11 and NSS 3.11.4

Question

Initializing SunPKCS11 for utilization of NSS 3.11.4 capabilities yields the following exception:
java.security.ProviderException: Could not initialize NSS
     at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:183)
     at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:90)
     at test.TripleDESTest.main(TripleDESTest.java:112)
Caused by: java.io.IOException: The specified version of NSS is incompatible, 3.7 or later required
     at sun.security.pkcs11.Secmod.initialize(Secmod.java:190)
     at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:179)
     ... 2 moreThe version I am using is greater than 3.7, despite what the exception says. I am looking to use the FIPS 140-2 certified symmetric key algorithms in this library.
I am using the following configuration:
name = NSScrypto
attributes = compatibility
nssLibraryDirectory = ./lib
nssDbMode = noDb
nssModule = fipsI am adding the cryptography provider dynamically with the following code:
String configName = "nss.cfg";
Provider cryptoProvider = new sun.security.pkcs11.SunPKCS11(configName);  // exception occurs on this line
Security.addProvider(cryptoProvider);Has anyone else run into this issue or have any insight into the problem?
Thanks!
Edited by: dmorriscdm on Oct 29, 2009 5:44 PM

Answer 1

Found out that the secmod database is required for performance in FIPS mode.
Nevertheless, this issue still persists...
The problem may be more deep-rooted in NSS compatibility than I originally thought (in such a way that utilizing JSS directly probably wouldn't work either).
I ran into issues creating the secmod database:
- Steps taken on the first Windows XP Professional Version 2002 SP2 box
1) "certutil -N -d ." ran fine, created the three database files with a strong password
2) "modutil -fips true -dbdir ." failed, with error:
"An I/O error occurred during security authorization.
ERROR: Unable to switch FIPS modes."
- Executed the same commands and same configuration on a Windows Vista box with success (output: "FIPS mode enabled.", and modutil -list shows the appropriate FIPS module).
- Executed the same commands and same configuration on a second Windows XP Professional Version 2002 SP2 box with success.
That was odd, but nevertheless, I now have a secmod database that I can work with.
Next, I copied the database files/directory into my Eclipse Java project and modified the NSS configuration file appropriately:
name = NSScrypto
attributes = compatibility
nssLibraryDirectory = ./lib
nssSecmodDirectory = ./nss_db
nssDbMode = readWrite
nssModule = fipsThis project is hosted on shared storage between both the Windows XP boxes. Running the test application (see previous message) on the original machine still produces the original exception:
java.security.ProviderException: Could not initialize NSS
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:183)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:90)
        at test.TripleDESTest.main(TripleDESTest.java:112)
Caused by: java.io.IOException: The specified version of NSS is
incompatible, 3.7 or later required
        at sun.security.pkcs11.Secmod.initialize(Secmod.java:190)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:179)
        ... 2 more Running the test application (the exact same Eclipse Java project, the same libraries, the same configuration) with the same JVM, jdk/jre 1.6.0_13, on the second Windows XP machine (where "modutil -fips true" succeeded) was successful (e.g., the crypto provider object was returned).
Any further insight into this issue would be appreciated!