Docker openjdk java AES 解密报错

java.security.InvalidKeyException: Illegal key size or default parameters

java.security.InvalidKeyException: Illegal key size or default parameters
        at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1026)
        at javax.crypto.Cipher.implInit(Cipher.java:801)
        at javax.crypto.Cipher.chooseProvider(Cipher.java:864)
        at javax.crypto.Cipher.init(Cipher.java:1249)
        at javax.crypto.Cipher.init(Cipher.java:1186)

定位是 AES-ECB解密JCE无限制权限策问题

docker 里的jdk版本

java -version
openjdk version "1.8.0_252"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_252-b09)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.252-b09, mixed mode)

openjdk为精简版jdk，对AES key有长度限制

查找JCE 里 local_policy.jar 和 US_export_policy.jar 包的位置

cd `echo $JAVA_HOME`/jre/lib/security
ll 
total 212
drwxr-xr-x. 1 root root     20 Oct 20  2021 ./
drwxr-xr-x. 1 root root     22 Oct 20  2021 ../
-rw-r--r--. 1 root root   2488 Oct 20  2021 blacklisted.certs
-rw-r--r--. 1 root root 152654 Oct 20  2021 cacerts
-rw-r--r--. 1 root root   2567 Oct 20  2021 java.policy
-rw-r--r--. 1 root root  51423 Oct 20  2021 java.security
drwxr-xr-x. 1 root root     23 Oct 20  2021 policy/

cd ./policy
ll
total 0
drwxr-xr-x. 1 root root 23 Oct 20  2021 ./
drwxr-xr-x. 1 root root 20 Oct 20  2021 ../
drwxr-xr-x. 1 root root 34 May 24 14:58 limited/
drwxr-xr-x. 1 root root 34 May 24 14:58 unlimited/

我们发现在容器的俩个位置都有这个包; 位置如下:
/opt/java/openjdk/jre/lib/security/policy/limited
/opt/java/openjdk/jre/lib/security/policy/unlimited

docker替换jar包
下载JCE无限制权限策略文件; 然后放在项目根下
(我是创建了 UnlimitedJCEPolicyJDK8文件夹存放)
(文末有JCE无限制权限策略文件下载地址)

# jre替换local_policy.jar和US_export_policy.jar JCE无限制权限策
COPY  UnlimitedJCEPolicyJDK8/local_policy.jar /opt/java/openjdk/jre/lib/security/policy/limited/local_policy.jar
COPY  UnlimitedJCEPolicyJDK8/US_export_policy.jar /opt/java/openjdk/jre/lib/security/policy/limited/US_export_policy.jar
COPY  UnlimitedJCEPolicyJDK8/local_policy.jar /opt/java/openjdk/jre/lib/security/policy/unlimited/local_policy.jar
COPY  UnlimitedJCEPolicyJDK8/US_export_policy.jar /opt/java/openjdk/jre/lib/security/policy/unlimited/US_export_policy.jar

完整的dockerfile文件

FROM adoptopenjdk/openjdk8
#指定时区
RUN ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime 
    && echo Asia/Shanghai > /etc/timezone
VOLUME /tmp
ARG JAR_FILE
#复制项目jar
COPY ${JAR_FILE} /auth/app.jar

# jre替换local_policy.jar和US_export_policy.jar JCE无限制权限策
COPY  UnlimitedJCEPolicyJDK8/local_policy.jar /opt/java/openjdk/jre/lib/security/policy/limited/local_policy.jar
COPY  UnlimitedJCEPolicyJDK8/US_export_policy.jar /opt/java/openjdk/jre/lib/security/policy/limited/US_export_policy.jar
COPY  UnlimitedJCEPolicyJDK8/local_policy.jar /opt/java/openjdk/jre/lib/security/policy/unlimited/local_policy.jar
COPY  UnlimitedJCEPolicyJDK8/US_export_policy.jar /opt/java/openjdk/jre/lib/security/policy/unlimited/US_export_policy.jar


ENTRYPOINT

官网

针对jdk1.8.44以下版本，请将jre/lib/security/ 下 的 local_policy.jar和US_export_policy.jar替换为官方网站提供了JCE无限制权限策略文件的下载：

JDK6的下载地址

JDK7的下载地址

JDK8的下载地址