Error with BouncyCastle in native images

[nitinty]

Hi Team,

I'm getting below error while using bouncyCastle in my quarkus application, I have tried below 2 following approach

Case 1) I have added the quarkus.security.security-providers=BC in my config. then getting below error.

com.oracle.svm.core.jdk.UnsupportedFeatureError: Trying to verify a provider that was not registered at build time: BC version 1.7801. All providers must be registered and verified in the Native Image builder.
at org.graalvm.nativeimage.builder/com.oracle.svm.core.util.VMError.unsupportedFeature(VMError.java:121)

Printed All provider list:

Provider: SUN
Provider: SunRsaSign
Provider: SunEC
Provider: SunJSSE
Provider: SunJCE
Provider: SunSASL
Provider: JdkLDAP
Provider: JdkSASL
Provider: Apple

Case 2) I have manually register the provider but in that case while I'm using it to get cipher instance

Cipher.getInstance("AES/ECB/PKCS7Padding", new BouncyCastleProvider()); then got the below error

java.security.NoSuchAlgorithmException: No such algorithm: AES/ECB/PKCS7Padding
at java.base@21.0.5/javax.crypto.Cipher.getInstance(Cipher.java:758)
at java.base@21.0.5/javax.crypto.Cipher.getInstance(Cipher.java:646)

@PostConstruct
    public void init() {
        if (Security.getProvider("BC") == null) {
            log.info("Registering BouncyCastle Provider...");
            Security.addProvider(new BouncyCastleProvider());
        } else {
            log.info("BouncyCastle provider already registered ");
        }
    }

Printed All provider list:

Provider: SUN
Provider: SunRsaSign
Provider: SunEC
Provider: SunJSSE
Provider: SunJCE
Provider: SunSASL
Provider: JdkLDAP
Provider: JdkSASL
Provider: Apple
Provider: BC

Can you please assist what should I do to use AES/ECB/PKCS7Padding with bouncy castle ?

[nitinty]

@sberyozkin @geoand
Can you please assist here ?

[sberyozkin]

Hi @nitinty, the BC native test passes on main with Java 21 on my laptop.

Can you create a reproducer ?

There is a strange warning which I don't recall seeing before:

warning: Could not register complete reflection metadata for org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi$X25519withSHA256HKDF. Reason(s): java.lang.IncompatibleClassChangeError: org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi and org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi$X25519withSHA256HKDF disagree on InnerClasses attribute.
Warning: Could not register complete reflection metadata for org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi$X448withSHA512HKDF. Reason(s): java.lang.IncompatibleClassChangeError: org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi and org.bouncycastle.jcajce.provider.asymmetric.edec.KeyAgreementSpi$X448withSHA512HKDF disagree on InnerClasses attribute

but this specific algorithm is not used in the test, @zakkak FYI.

[nitinty]

@sberyozkin
Sorry for late reply

PFA reproducer for this issue

bouncy-castle-issue-reproducer.zip

Command to run:
mvn clean install -Dnative -DskipTests

./target/bouncy-castle-issue-reproducer-1.0.0-SNAPSHOT-runner

Curl: curl -X GET http://0.0.0.0:8080/hello

[sberyozkin]

@nitinty Np, thanks for creating the reproducer. Adding the quarkus-security dependency as documented at the top of the doc at https://quarkus.io/guides/security-customization#quarkus-security-dependency resolves the problem.

[nitinty]

@sberyozkin
Apologies for the confusion! I mistakenly mixed up the dependencies, as one was coming in as a transitive dependency. Thanks for pointing it out!

  <dependency>
      <groupId>io.quarkus.security</groupId>
      <artifactId>quarkus-security</artifactId>
  </dependency>

and

<dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-security</artifactId>
  </dependency