I know how to use non-FIPS version of BouncyCastle cryptography library for transparent Amazon S3 client-side encryption handled by EMRFS client in my AWS EMR cluster, but when I try to use FIPS-certified version of BouncyCastle library (i.e. BCFIPS) I'm getting following
Caused by: java.lang.NoSuchFieldError: id_alg_AEADChaCha20Poly1305
at org.bouncycastle.jcajce.provider.symmetric.ChaCha$Mappings.configure(Unknown Source)
at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(Unknown Source)
at org.bouncycastle.jce.provider.BouncyCastleProvider.setup(Unknown Source)
at org.bouncycastle.jce.provider.BouncyCastleProvider.access$000(Unknown Source)
at org.bouncycastle.jce.provider.BouncyCastleProvider$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(Unknown Source)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at java.lang.Class.newInstance(Class.java:442)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.internal.crypto.CryptoRuntime.enableBouncyCastle(CryptoRuntime.java:39)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.CryptoConfiguration.check(CryptoConfiguration.java:313)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.CryptoConfiguration.setCryptoMode(CryptoConfiguration.java:240)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.internal.crypto.v1.CryptoModuleDispatcher.<init>(CryptoModuleDispatcher.java:91)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3EncryptionClient.<init>(AmazonS3EncryptionClient.java:537)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3EncryptionClientBuilder.build(AmazonS3EncryptionClientBuilder.java:111)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3EncryptionClientBuilder.build(AmazonS3EncryptionClientBuilder.java:27)
at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.client.builder.AwsSyncClientBuilder.build(AwsSyncClientBuilder.java:46)
From this stack-trace it looks like EMRFS using S3 encryption client (i.e. AmazonS3EncryptionClient) which is trying to instantiate non-FIPS BouncyCastleProvider instead of BouncyCastleFipsProvider.
So, question is how to force EMRFS to use FIPS-certified BouncyCastle library (i.e. BCFIPS) if it is supported by AWS at all?
This is what I'm looking for:
