如何将SSLEngine限制为TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 CipherSuite？

Question

我有以下代码：

SSLContext sslContext = SSLContext.getInstance("TLS", BouncyCastleProvider.PROVIDER_NAME);
sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
SSLEngine sslEngine = sslContext.createSSLEngine();
String[] suites = { "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" };
sslEngine.setEnabledCipherSuites(suites);

谢谢。

编辑：我发现我应该使用需要SecureRandom对象的BouncyCastleJsseProvider，如下所示：

sslContext.init(keyManagerFactory.getKeyManagers(), null, new SecureRandom());

使用新提供程序之后，我将在代码库中获得以下堆栈跟踪，正如我所理解的，它应该像以前一样工作：

Aug 17, 2017 8:47:32 PM org.bouncycastle.jsse.provider.ProvTlsServer notifyAlertRaised
INFO: Server raised fatal(2) handshake_failure(40) alert: Failed to read record
org.bouncycastle.tls.TlsFatalAlert: handshake_failure(40)
    at org.bouncycastle.tls.AbstractTlsServer.getSelectedCipherSuite(Unknown Source)
    at org.bouncycastle.jsse.provider.ProvTlsServer.getSelectedCipherSuite(Unknown Source)
    at org.bouncycastle.tls.TlsServerProtocol.sendServerHelloMessage(Unknown Source)
    at org.bouncycastle.tls.TlsServerProtocol.handleHandshakeMessage(Unknown Source)
    at org.bouncycastle.tls.TlsProtocol.processHandshakeQueue(Unknown Source)
    at org.bouncycastle.tls.TlsProtocol.processRecord(Unknown Source)
    at org.bouncycastle.tls.RecordStream.readRecord(Unknown Source)
    at org.bouncycastle.tls.TlsProtocol.safeReadRecord(Unknown Source)
    at org.bouncycastle.tls.TlsProtocol.offerInput(Unknown Source)
    at org.bouncycastle.jsse.provider.ProvSSLEngine.unwrap(Unknown Source)

Answer 1

我做了下面的工作，以使它发挥作用。

• 添加提供程序：BouncyCastleProvider和BouncyCastleJsseProvider Security.addProvider(新BouncyCastleProvider())；Security.addProvider(新BouncyCastleJsseProvider())；
• 使用SSLContext创建BouncyCastleJsseProvider SSLContext sslContext = SSLContext.getInstance("TLS"，BouncyCastleJsseProvider.PROVIDER_NAME)；
• 使用带有sslContext的SecureRandom实例初始化BouncyCastleProvider sslContext.init( keyManagers，trustManagers，SecureRandom.getInstance(“默认”，BouncyCastleProvider.PROVIDER_NAME))；
• 您可能需要使用KeyManagerFactory和BouncyCastleJsseProvider和PKIX算法来创建 KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("PKIX"，BouncyCastleJsseProvider.PROVIDER_NAME)；
• 现在，我们能够启用密码套件 SSLEngine sslEngine = sslContext.createSSLEngine()；String[]套房={ "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8“}；sslEngine.setEnabledCipherSuites(套房)；