Re: Exception in filter (was: Re: [Vote] MINA 2.2.0 release)

2022-07-08 Thread Jonathan Valliere
Sooo… do I need to look into this or was this resolved?

On Fri, Jul 8, 2022 at 11:51 PM Emmanuel Lécharny 
wrote:

> The changes I did were to ensure that any ouutbound data are sent when a
> TLS erroroccurs, because the Alert must be sent no matter what. This is
> critical for a client to know what is the cause of the failure
> (typically when a bad certificate is provided - expired, revoked, etc -):
> https://datatracker.ietf.org/doc/html/rfc5246#section-7.2
>
> I also checked that in this case an exception is propagated up to the
> IoHandler for teh server to be informed about the situuation.
>
>
> On 06/07/2022 12:42, Jonathan Valliere wrote:
> >   What test are you trying?  Emmanuel made changes from the original
> design
> > to cause it to throw on the filter.  My original design threw on the
> filter
> > but only during a subsequent read or write action thereby enforcing
> strong
> > concurrency within the pipeline.
> >
> > On Jul 6, 2022 at 3:53:57 AM, Christoph John
> >  wrote:
> >
> >> Ok, the tests in QuickFIX/J which expect the exception to be caught in a
> >> filter still don't work.
> >> I recall that you also did some changes in other Apache projects to make
> >> it work with MINA 2.2.0. Could it be that I also need to adapt
> something in
> >> this regard?
> >>
> >> Thanks
> >> Chris
> >>
> >> Jul 5, 2022 18:47:09 Emmanuel Lécharny :
> >>
> >> I have tested that the exception gets propagated before launching the
> vote
> >> to be clear :-)
> >>
> >>
> >> On 05/07/2022 18:17, Christoph John wrote:
> >>
> >>> Sorry, no. The last message regarding this was:
> >>
> >>>
> >>
> >>> --snip-
> >>
> >>>
> >>
> >>> 11.04.2022 09:37:30 Emmanuel Lécharny :
> >>
> >>> Hi Christophe,
> >>
> >>> sorry, my late mail was off base.
> >>
> >>> The pb here is that the SSLEngine excpeiton is not propagated to the
> >> handler, when it should.
> >>
> >>> My guess is that we have some missing call somewhere in the stack. I'm
> >> going to check that out.
> >>
> >>> On 11/04/2022 00:15, Christoph John wrote:
> >>
>  Hi,
> >>
>  thanks Jonathan and Emmanuel for working on this!
> >>
>  I tried to integrate this into QuickFIX/J and it compiles
> successfully.
> >> However there are some tests failing that expect an Exception. For
> example
> >> we have
> >>
> 
> >>
> https://github.com/quickfix-j/quickfixj/blob/b6a822a46a5278dcd0985a5a77299ed03168ab03/quickfixj-core/src/test/java/quickfix/mina/ssl/SecureSocketTest.java#L54
> >>
>  Up to now it was tried to get the Exception via a filter in the chain.
> >> This no longer seems to work but I think I can see the error getting
> thrown
> >> in the log:
> >>
>  SEVERE: SSLHandlerG0@590ec99c[mode=server, connected=false] task() -
> >> storing error {}
> >>
>  javax.net.ssl.SSLHandshakeException: No available authentication
> scheme
> >>
>   at
> >> java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
> >>
>   at
> >> java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
> >>
>   at
> >>
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:358)
> >>
>   at
> >>
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
> >>
>   at
> >>
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:305)
> >>
>   at
> >>
> java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.onProduceCertificate(CertificateMessage.java:972)
> >>
>   at
> >>
> java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.produce(CertificateMessage.java:961)
> >>
>   at
> >> java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:440)
> >>
>   at
> >>
> java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1246)
> >>
>   at
> >>
> java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1182)
> >>
>   at
> >>
> java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:840)
> >>
>   at
> >>
> java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:801)
> >>
>   at
> >> java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
> >>
>   at
> >>
> java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
> >>
>   at
> >>
> java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
> >>
>   at
> >>
> java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
> >>
>   at
> >>
> java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
> >>
>   at
> >>
> java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
> >>
>   at
> >>
> org.apache.mina.filter.ssl.SSLHandlerG0.execute_task(SSLHandlerG0.java:743)
>

Re: Exception in filter (was: Re: [Vote] MINA 2.2.0 release)

2022-07-08 Thread Emmanuel Lécharny
The changes I did were to ensure that any ouutbound data are sent when a 
TLS erroroccurs, because the Alert must be sent no matter what. This is 
critical for a client to know what is the cause of the failure 
(typically when a bad certificate is provided - expired, revoked, etc -):

https://datatracker.ietf.org/doc/html/rfc5246#section-7.2

I also checked that in this case an exception is propagated up to the 
IoHandler for teh server to be informed about the situuation.



On 06/07/2022 12:42, Jonathan Valliere wrote:

  What test are you trying?  Emmanuel made changes from the original design
to cause it to throw on the filter.  My original design threw on the filter
but only during a subsequent read or write action thereby enforcing strong
concurrency within the pipeline.

On Jul 6, 2022 at 3:53:57 AM, Christoph John
 wrote:


Ok, the tests in QuickFIX/J which expect the exception to be caught in a
filter still don't work.
I recall that you also did some changes in other Apache projects to make
it work with MINA 2.2.0. Could it be that I also need to adapt something in
this regard?

Thanks
Chris

Jul 5, 2022 18:47:09 Emmanuel Lécharny :

I have tested that the exception gets propagated before launching the vote
to be clear :-)


On 05/07/2022 18:17, Christoph John wrote:


Sorry, no. The last message regarding this was:







--snip-







11.04.2022 09:37:30 Emmanuel Lécharny :



Hi Christophe,



sorry, my late mail was off base.



The pb here is that the SSLEngine excpeiton is not propagated to the

handler, when it should.


My guess is that we have some missing call somewhere in the stack. I'm

going to check that out.


On 11/04/2022 00:15, Christoph John wrote:



Hi,



thanks Jonathan and Emmanuel for working on this!



I tried to integrate this into QuickFIX/J and it compiles successfully.

However there are some tests failing that expect an Exception. For example
we have




https://github.com/quickfix-j/quickfixj/blob/b6a822a46a5278dcd0985a5a77299ed03168ab03/quickfixj-core/src/test/java/quickfix/mina/ssl/SecureSocketTest.java#L54


Up to now it was tried to get the Exception via a filter in the chain.

This no longer seems to work but I think I can see the error getting thrown
in the log:


SEVERE: SSLHandlerG0@590ec99c[mode=server, connected=false] task() -

storing error {}


javax.net.ssl.SSLHandshakeException: No available authentication scheme



 at

java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)


 at

java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)


 at

java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:358)


 at

java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)


 at

java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:305)


 at

java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.onProduceCertificate(CertificateMessage.java:972)


 at

java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.produce(CertificateMessage.java:961)


 at

java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:440)


 at

java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1246)


 at

java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1182)


 at

java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:840)


 at

java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:801)


 at

java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)


 at

java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)


 at

java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)


 at

java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)


 at

java.base/java.security.AccessController.doPrivileged(AccessController.java:712)


 at

java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)


 at

org.apache.mina.filter.ssl.SSLHandlerG0.execute_task(SSLHandlerG0.java:743)


 at

org.apache.mina.filter.ssl.SSLHandlerG0.receive_loop(SSLHandlerG0.java:255)


 at

org.apache.mina.filter.ssl.SSLHandlerG0.receive(SSLHandlerG0.java:162)


 at

org.apache.mina.filter.ssl.SslFilter.messageReceived(SslFilter.java:342)


 at

org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650)


 at

org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:49)


 at

org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:1128)


 at

org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:122)


 at

org.apache.

[jira] [Commented] (SSHD-1277) Error connecting to particular SFTP server after enabling HostKeyAlgorithms rsa-sha2-256 rsa-sha2-512 on SFTP client

2022-07-08 Thread Roberto Deandrea (Jira)


[ 
https://issues.apache.org/jira/browse/SSHD-1277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17564320#comment-17564320
 ] 

Roberto Deandrea commented on SSHD-1277:


Thomas,

Unfortunately this kind of SSH server is hosted by a partner of one of our 
customer and I'm not able to get this information.

 

Best Regards

Roberto

 

> Error connecting to particular SFTP server after enabling HostKeyAlgorithms 
> rsa-sha2-256 rsa-sha2-512 on SFTP client
> 
>
> Key: SSHD-1277
> URL: https://issues.apache.org/jira/browse/SSHD-1277
> Project: MINA SSHD
>  Issue Type: Bug
>Affects Versions: 2.8.0
> Environment: java.runtime = Java(TM) SE Runtime Environment (8.0.6.10 
> - pxa6480sr6fp10-20200408_01(SR6 FP10))
> os = Linux (3.10.0-1160.42.2.el7.x86_64; amd64) (en_US)
>Reporter: Roberto Deandrea
>Priority: Major
> Attachments: trace_apachesshd_client.log
>
>
> Hi Thomas,
> I have a strange issue with an SFTP client connection based on Apache SSHD 
> 2.8.0 client.
> After enabling the support for server HostKeyAlgorithms 
> rsa-sha2-256,rsa-sha2-512 with this code:
> _SshClient sshClient = SshClient.setUpDefaultClient();_ 
>  _sshClient.setSignatureFactories(Arrays.> asList( 
> BuiltinSignatures.rsa,_ 
> _BuiltinSignatures.rsaSHA256,_ 
> _BuiltinSignatures.rsaSHA512));_
>  
> the SFTP connection fails against a particular server with the following 
> stack trace :
> [6/28/22 5:32:46:783 EDT] 4102 id= 
> org.apache.sshd.common.util.logging.LoggingUtils             W warn 
> exceptionCaught(ClientSessionImpl[StateStreetDS.sftpuser@/127.0.0.1:46323])[state=Opened]
>  SignatureException: Signature encoding error
> java.security.SignatureException: Signature encoding error
>         at com.ibm.crypto.fips.provider.RSASignature.a(Unknown Source)
>         at com.ibm.crypto.fips.provider.RSASignature.engineVerify(Unknown 
> Source)
>         at java.security.Signature$Delegate.engineVerify(Signature.java:1231)
>         at java.security.Signature.verify(Signature.java:661)
>         at 
> org.apache.sshd.common.signature.AbstractSignature.doVerify(AbstractSignature.java:164)
>         at 
> org.apache.sshd.common.signature.SignatureRSA.verify(SignatureRSA.java:116)
>         at org.apache.sshd.client.kex.DHGClient.next(DHGClient.java:181)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:633)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:452)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:412)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64)
>         at 
> org.apache.sshd.netty.NettyIoSession.channelRead(NettyIoSession.java:252)
>         at 
> org.apache.sshd.netty.NettyIoSession$Adapter.channelRead(NettyIoSession.java:296)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:271)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
>         at 
> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
>         at 
> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719)
>         at 
> io.netty.channel.nio.NioEventLoop.processSelectedKey

[jira] [Closed] (SSHD-1277) Error connecting to particular SFTP server after enabling HostKeyAlgorithms rsa-sha2-256 rsa-sha2-512 on SFTP client

2022-07-08 Thread Thomas Wolf (Jira)


 [ 
https://issues.apache.org/jira/browse/SSHD-1277?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Thomas Wolf closed SSHD-1277.
-
Resolution: Not A Bug

OK, closing.

Out of interest: do you know what kind of SSH server this "PFaroeFTPServer" is 
using? And if OpenSSH, which version?

> Error connecting to particular SFTP server after enabling HostKeyAlgorithms 
> rsa-sha2-256 rsa-sha2-512 on SFTP client
> 
>
> Key: SSHD-1277
> URL: https://issues.apache.org/jira/browse/SSHD-1277
> Project: MINA SSHD
>  Issue Type: Bug
>Affects Versions: 2.8.0
> Environment: java.runtime = Java(TM) SE Runtime Environment (8.0.6.10 
> - pxa6480sr6fp10-20200408_01(SR6 FP10))
> os = Linux (3.10.0-1160.42.2.el7.x86_64; amd64) (en_US)
>Reporter: Roberto Deandrea
>Priority: Major
> Attachments: trace_apachesshd_client.log
>
>
> Hi Thomas,
> I have a strange issue with an SFTP client connection based on Apache SSHD 
> 2.8.0 client.
> After enabling the support for server HostKeyAlgorithms 
> rsa-sha2-256,rsa-sha2-512 with this code:
> _SshClient sshClient = SshClient.setUpDefaultClient();_ 
>  _sshClient.setSignatureFactories(Arrays.> asList( 
> BuiltinSignatures.rsa,_ 
> _BuiltinSignatures.rsaSHA256,_ 
> _BuiltinSignatures.rsaSHA512));_
>  
> the SFTP connection fails against a particular server with the following 
> stack trace :
> [6/28/22 5:32:46:783 EDT] 4102 id= 
> org.apache.sshd.common.util.logging.LoggingUtils             W warn 
> exceptionCaught(ClientSessionImpl[StateStreetDS.sftpuser@/127.0.0.1:46323])[state=Opened]
>  SignatureException: Signature encoding error
> java.security.SignatureException: Signature encoding error
>         at com.ibm.crypto.fips.provider.RSASignature.a(Unknown Source)
>         at com.ibm.crypto.fips.provider.RSASignature.engineVerify(Unknown 
> Source)
>         at java.security.Signature$Delegate.engineVerify(Signature.java:1231)
>         at java.security.Signature.verify(Signature.java:661)
>         at 
> org.apache.sshd.common.signature.AbstractSignature.doVerify(AbstractSignature.java:164)
>         at 
> org.apache.sshd.common.signature.SignatureRSA.verify(SignatureRSA.java:116)
>         at org.apache.sshd.client.kex.DHGClient.next(DHGClient.java:181)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:633)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:452)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:412)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64)
>         at 
> org.apache.sshd.netty.NettyIoSession.channelRead(NettyIoSession.java:252)
>         at 
> org.apache.sshd.netty.NettyIoSession$Adapter.channelRead(NettyIoSession.java:296)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:271)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
>         at 
> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
>         at 
> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719)
>         at 
> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:655)
>         at 
> io.netty.channel.nio.NioEv

[jira] [Commented] (SSHD-1277) Error connecting to particular SFTP server after enabling HostKeyAlgorithms rsa-sha2-256 rsa-sha2-512 on SFTP client

2022-07-08 Thread Roberto Deandrea (Jira)


[ 
https://issues.apache.org/jira/browse/SSHD-1277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17564294#comment-17564294
 ] 

Roberto Deandrea commented on SSHD-1277:


Hi Thomas,

Changing the signature algorithms as you suggested definitely fix the issue.

Feel free to close the ticket.

Thank you very much for your support

 

Kind Regards

Roberto

 

> Error connecting to particular SFTP server after enabling HostKeyAlgorithms 
> rsa-sha2-256 rsa-sha2-512 on SFTP client
> 
>
> Key: SSHD-1277
> URL: https://issues.apache.org/jira/browse/SSHD-1277
> Project: MINA SSHD
>  Issue Type: Bug
>Affects Versions: 2.8.0
> Environment: java.runtime = Java(TM) SE Runtime Environment (8.0.6.10 
> - pxa6480sr6fp10-20200408_01(SR6 FP10))
> os = Linux (3.10.0-1160.42.2.el7.x86_64; amd64) (en_US)
>Reporter: Roberto Deandrea
>Priority: Major
> Attachments: trace_apachesshd_client.log
>
>
> Hi Thomas,
> I have a strange issue with an SFTP client connection based on Apache SSHD 
> 2.8.0 client.
> After enabling the support for server HostKeyAlgorithms 
> rsa-sha2-256,rsa-sha2-512 with this code:
> _SshClient sshClient = SshClient.setUpDefaultClient();_ 
>  _sshClient.setSignatureFactories(Arrays.> asList( 
> BuiltinSignatures.rsa,_ 
> _BuiltinSignatures.rsaSHA256,_ 
> _BuiltinSignatures.rsaSHA512));_
>  
> the SFTP connection fails against a particular server with the following 
> stack trace :
> [6/28/22 5:32:46:783 EDT] 4102 id= 
> org.apache.sshd.common.util.logging.LoggingUtils             W warn 
> exceptionCaught(ClientSessionImpl[StateStreetDS.sftpuser@/127.0.0.1:46323])[state=Opened]
>  SignatureException: Signature encoding error
> java.security.SignatureException: Signature encoding error
>         at com.ibm.crypto.fips.provider.RSASignature.a(Unknown Source)
>         at com.ibm.crypto.fips.provider.RSASignature.engineVerify(Unknown 
> Source)
>         at java.security.Signature$Delegate.engineVerify(Signature.java:1231)
>         at java.security.Signature.verify(Signature.java:661)
>         at 
> org.apache.sshd.common.signature.AbstractSignature.doVerify(AbstractSignature.java:164)
>         at 
> org.apache.sshd.common.signature.SignatureRSA.verify(SignatureRSA.java:116)
>         at org.apache.sshd.client.kex.DHGClient.next(DHGClient.java:181)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:633)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:452)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1524)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:412)
>         at 
> org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64)
>         at 
> org.apache.sshd.netty.NettyIoSession.channelRead(NettyIoSession.java:252)
>         at 
> org.apache.sshd.netty.NettyIoSession$Adapter.channelRead(NettyIoSession.java:296)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:271)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
>         at 
> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
>         at 
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
>         at 
> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
>         at 
> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
>         at 
> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719)
>         at 
> io.netty.channel.nio.NioEvent