Question

I am using the IBM Websphere Everyplace Micro Environment JVM on a Windows Mobile 6 device. My application uses HTTPS connections and I have everything set up appropriately to use the J9JSSE package for SSL/TLS. Some messages that are being transmitted on the HTTPS connection are getting through just fine, but others are causing an exception on the client:

java.io.IOException: invalid padding
    at com.ibm.oti.crypto.Util.unpadTLS10(Unknown Source)
    at com.ibm.oti.crypto.CL3BasedProvider.decryptImpl(Unknown Source)
    at com.ibm.oti.crypto.CL3BasedProvider.cryptUpdate(Unknown Source)
    at com.ibm.oti.crypto.Key.cryptFinish(Unknown Source)
    at com.ibm.j9.ssl.CipherAlgorithm.decipher(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl.readData(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl$SSLInputStream.read(Unknown Source)
    at com.ibm.j9.jsse.SSLSocketImpl$SSLInputStream.read(Unknown Source)
    at java.io.BufferedInputStream.fillbuf(Unknown Source)
    at java.io.BufferedInputStream.read(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.readln(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.readServerResponse(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.sendRequest(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.doRequest(Unknown Source)
    at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.getInputStream(Unknown Source)

I have tried playing around with the Apache Tomcat server to confgure the cipher suite that is being used and the only one that will work is:

SSL_RSA_WITH_NULL_SHA

but this doesn’t actually do any encryption (specified here by the null) so it is of no use to me. The default cipher suite that is used is:

SSL_RSA_WITH_3DES_EDE_CBC_SHA

And this along with all others that I have tried have this padding problem. Does anyone know what might be causing the problem and how I might solve it?

I found a single forum post where someone suggested that there was a bug in the J9 CBC implementation, but it seems strange that there is no other information on this anywhere online. Any help with this issue would be greatly appreciated.

Answer 1

So the ultimate answer I came to was to switch to a different JVM. Very little support available from IBM and just trying to get someone to sell us licences for their JVM was proving very difficult. I guess they only like to deal with huge organisations.

Now using CEE-J from Skelmir and so far it is a lot more promising.