title: keytool versus FIPS when handling PKCS12 keystores
body: <p><strong>Background:  What Works</strong></p>
  
  <p>From time to time we have to use a piece of Java software that reads PKCS#12 keystores.  For this particular project, we have to create public/private pairs on an as-needed basis, and we store the keys in PKCS12 files because it's stable and pretty much everything can read that format.</p>
  
  <p>Because we do a lot of Java in-house, we have <code>keytool</code> sitting around, and so we figured hey, just use keytool to create the private key and certificate.  A typical instance looks like this:</p>
  
  <pre><code>keytool -keystore MyLuggage.p12 -storepass 123456 -storetype pkcs12
     -alias "......"
     -genkeypair -keyalg RSA -keysize typically_2048_or_3072 -sigalg SHA256withRSA
  
     -ext "KeyUsage=dataEncipherment,digitalSignature,keyEncipherment"
     -startdate ....
     -dname "......."
  </code></pre>
  
  <p>The actual <code>-keysize</code> varies between 2048 and 8192 in practice; for the purposes of this question it hasn't seemed to make a difference what gets used, but obviously we use key lengths appropriate to the task if we get to choose them at all (usually dictated by the constraints of other software, or dictated by some regulation that's handed to us).</p>
  
  <p>This has always worked, in that other software -- including the Java software mentioned at the start -- can read the keystore and make use of the private keys within.  (And the public key can be exported and used, etc.)</p>
  
  <p><strong>Here's What Breaks</strong></p>
  
  <p>The software recently got upgraded to a version that uses the FIPS 140 certified Java libraries from RSA.  ("BSAFE" or "JSAFE" depending on who you ask.)  And now, trying to open previously-created PKCS#12 files fails with</p>
  
  <pre><code>java.lang.SecurityException: Algorithm not allowable in FIPS140 mode: PBE/PKCS12/SHA1/RC2/CBC/40
      at ......
      at java.security.KeyStore.load(Unknown Source)
  </code></pre>
  
  <p>The elided ...... frames are in the RSA source that we don't have and looks to use function names that have been obfuscated in any case.  So looking at their source to try and figure out what exactly it's testing to cause this, isn't an option.</p>
  
  <p>So, what <em>is</em> causing this?  The only algorithms we've chosen are the "RSA" key generation and "SHA256withRSA" signature, both of which are permitted by FIPS 140-2.  I've been looking again through <code>keytool -genkeypair -help</code> output and there don't seem to be any other algorithm or security options.  (We've avoided using <code>-keypass</code> because PKCS#12 tools really hate it when the keystore password and the key password are different, and <code>keytool -genkeypair</code> defaults the key password to the keystore password.)  The rest of the error message is confusing, as we don't specify the use of SHA-1 or RC2 (!) anywhere.</p>
  
  <p>Googling around points to people having trouble with creating SSL certificates, which we're not doing here, and the solutions given seem to be specific to Tomcat.</p>
  
  <p>Is this a problem with how we're creating the keystore, how we're creating the key pair <em>in</em> the keystore, or some "feature" of FIPS 140 that we haven't previously encountered?</p>