diff --git a/make/autoconf/lib-sysconf.m4 b/make/autoconf/lib-sysconf.m4

new file mode 100644

index 00000000000..b2b1c1787da

--- /dev/null

+++ b/make/autoconf/lib-sysconf.m4

@@ -0,0 +1,84 @@

+#

+# Copyright (c) 2021, Red Hat, Inc.

+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

+#

+# This code is free software; you can redistribute it and/or modify it

+# under the terms of the GNU General Public License version 2 only, as

+# published by the Free Software Foundation.  Oracle designates this

+# particular file as subject to the "Classpath" exception as provided

+# by Oracle in the LICENSE file that accompanied this code.

+#

+# This code is distributed in the hope that it will be useful, but WITHOUT

+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

+# version 2 for more details (a copy is included in the LICENSE file that

+# accompanied this code).

+#

+# You should have received a copy of the GNU General Public License version

+# 2 along with this work; if not, write to the Free Software Foundation,

+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

+#

+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

+# or visit www.oracle.com if you need additional information or have any

+# questions.

+#

+

+################################################################################

+# Setup system configuration libraries

+################################################################################

+AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],

+[

+  ###############################################################################

+  #

+  # Check for the NSS library

+  #

+

+  AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)])

+

+  # default is not available

+  DEFAULT_SYSCONF_NSS=no

+

+  AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],

+     [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])],

+  [

+    case "${enableval}" in

+      yes)

+        sysconf_nss=yes

+        ;;

+      *)

+        sysconf_nss=no

+        ;;

+    esac

+  ],

+  [

+    sysconf_nss=${DEFAULT_SYSCONF_NSS}

+  ])

+  AC_MSG_RESULT([$sysconf_nss])

+

+  USE_SYSCONF_NSS=false

+  if test "x${sysconf_nss}" = "xyes"; then

+      PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])

+      if test "x${NSS_FOUND}" = "xyes"; then

+         AC_MSG_CHECKING([for system FIPS support in NSS])

+         saved_libs="${LIBS}"

+         saved_cflags="${CFLAGS}"

+         CFLAGS="${CFLAGS} ${NSS_CFLAGS}"

+         LIBS="${LIBS} ${NSS_LIBS}"

+         AC_LANG_PUSH([C])

+         AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]],

+                                         [[SECMOD_GetSystemFIPSEnabled()]])],

+                        [AC_MSG_RESULT([yes])],

+                        [AC_MSG_RESULT([no])

+                        AC_MSG_ERROR([System NSS FIPS detection unavailable])])

+         AC_LANG_POP([C])

+         CFLAGS="${saved_cflags}"

+         LIBS="${saved_libs}"

+         USE_SYSCONF_NSS=true

+      else

+         dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API

+         dnl in nss3/pk11pub.h.

+         AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.])

+      fi

+  fi

+  AC_SUBST(USE_SYSCONF_NSS)

+])

diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4

index a65d91ee974..a8f054c1397 100644

--- a/make/autoconf/libraries.m4

+++ b/make/autoconf/libraries.m4

@@ -33,6 +33,7 @@ m4_include([lib-std.m4])

 m4_include([lib-x11.m4])

 m4_include([lib-fontconfig.m4])

 m4_include([lib-tests.m4])

+m4_include([lib-sysconf.m4])

 ################################################################################

 # Determine which libraries are needed for this configuration

@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],

   LIB_SETUP_BUNDLED_LIBS

   LIB_SETUP_MISC_LIBS

   LIB_TESTS_SETUP_GTEST

+  LIB_SETUP_SYSCONF_LIBS

   BASIC_JDKLIB_LIBS=""

   if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then

diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in

index c2c9c4adf3a..9d105b37acf 100644

--- a/make/autoconf/spec.gmk.in

+++ b/make/autoconf/spec.gmk.in

@@ -836,6 +836,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@

 # Libraries

 #

+USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@

+NSS_LIBS:=@NSS_LIBS@

+NSS_CFLAGS:=@NSS_CFLAGS@

+

 USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@

 LCMS_CFLAGS:=@LCMS_CFLAGS@

 LCMS_LIBS:=@LCMS_LIBS@

diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk

index 5658ff342e5..cb7a56852f7 100644

--- a/make/modules/java.base/Lib.gmk

+++ b/make/modules/java.base/Lib.gmk

@@ -167,6 +167,31 @@ ifeq ($(call isTargetOsType, unix), true)

   endif

 endif

+################################################################################

+# Create the systemconf library

+

+LIBSYSTEMCONF_CFLAGS :=

+LIBSYSTEMCONF_CXXFLAGS :=

+

+ifeq ($(USE_SYSCONF_NSS), true)

+  LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS

+  LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS

+endif

+

+ifeq ($(OPENJDK_BUILD_OS), linux)

+  $(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \

+      NAME := systemconf, \

+      OPTIMIZATION := LOW, \

+      CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \

+      CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \

+      LDFLAGS := $(LDFLAGS_JDKLIB) \

+          $(call SET_SHARED_LIBRARY_ORIGIN), \

+      LIBS_unix := $(LIBDL) $(NSS_LIBS), \

+  ))

+

+  TARGETS += $(BUILD_LIBSYSTEMCONF)

+endif

+

 ################################################################################

 # Create the symbols file for static builds.

diff --git a/src/java.base/linux/native/libsystemconf/systemconf.c b/src/java.base/linux/native/libsystemconf/systemconf.c

new file mode 100644

index 00000000000..8dcb7d9073f

--- /dev/null

+++ b/src/java.base/linux/native/libsystemconf/systemconf.c

@@ -0,0 +1,224 @@

+/*

+ * Copyright (c) 2021, Red Hat, Inc.

+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

+ *

+ * This code is free software; you can redistribute it and/or modify it

+ * under the terms of the GNU General Public License version 2 only, as

+ * published by the Free Software Foundation.  Oracle designates this

+ * particular file as subject to the "Classpath" exception as provided

+ * by Oracle in the LICENSE file that accompanied this code.

+ *

+ * This code is distributed in the hope that it will be useful, but WITHOUT

+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

+ * version 2 for more details (a copy is included in the LICENSE file that

+ * accompanied this code).

+ *

+ * You should have received a copy of the GNU General Public License version

+ * 2 along with this work; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

+ *

+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

+ * or visit www.oracle.com if you need additional information or have any

+ * questions.

+ */

+

+#include <jni.h>

+#include <jni_util.h>

+#include "jvm_md.h"

+#include <stdio.h>

+

+#ifdef SYSCONF_NSS

+#include <nss3/pk11pub.h>

+#else

+#include <dlfcn.h>

+#endif //SYSCONF_NSS

+

+#include "java_security_SystemConfigurator.h"

+

+#define MSG_MAX_SIZE 256

+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"

+

+typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void);

+

+static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled;

+static jmethodID debugPrintlnMethodID = NULL;

+static jobject debugObj = NULL;

+

+static void dbgPrint(JNIEnv *env, const char* msg)

+{

+    jstring jMsg;

+    if (debugObj != NULL) {

+        jMsg = (*env)->NewStringUTF(env, msg);

+        CHECK_NULL(jMsg);

+        (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);

+    }

+}

+

+static void throwIOException(JNIEnv *env, const char *msg)

+{

+    jclass cls = (*env)->FindClass(env, "java/io/IOException");

+    if (cls != 0)

+        (*env)->ThrowNew(env, cls, msg);

+}

+

+static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes)

+{

+  if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {

+    dbgPrint(env, msg);

+  } else {

+    dbgPrint(env, "systemconf: cannot render message");

+  }

+}

+

+// Only used when NSS is not linked at build time

+#ifndef SYSCONF_NSS

+

+static void *nss_handle;

+

+static jboolean loadNSS(JNIEnv *env)

+{

+  char msg[MSG_MAX_SIZE];

+  int msg_bytes;

+  const char* errmsg;

+

+  nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY);

+  if (nss_handle == NULL) {

+    errmsg = dlerror();

+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n",

+                         errmsg);

+    handle_msg(env, msg, msg_bytes);

+    return JNI_FALSE;

+  }

+  dlerror(); /* Clear errors */

+  getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled");

+  if ((errmsg = dlerror()) != NULL) {

+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n",

+                         errmsg);

+    handle_msg(env, msg, msg_bytes);

+    return JNI_FALSE;

+  }

+  return JNI_TRUE;

+}

+

+static void closeNSS(JNIEnv *env)

+{

+  char msg[MSG_MAX_SIZE];

+  int msg_bytes;

+  const char* errmsg;

+

+  if (dlclose(nss_handle) != 0) {

+    errmsg = dlerror();

+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n",

+                         errmsg);

+    handle_msg(env, msg, msg_bytes);

+  }

+}

+

+#endif

+

+/*

+ * Class:     java_security_SystemConfigurator

+ * Method:    JNI_OnLoad

+ */

+JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)

+{

+    JNIEnv *env;

+    jclass sysConfCls, debugCls;

+    jfieldID sdebugFld;

+

+    if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {

+        return JNI_EVERSION; /* JNI version not supported */

+    }

+

+    sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator");

+    if (sysConfCls == NULL) {

+        printf("libsystemconf: SystemConfigurator class not found\n");

+        return JNI_ERR;

+    }

+    sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,

+            "sdebug", "Lsun/security/util/Debug;");

+    if (sdebugFld == NULL) {

+        printf("libsystemconf: SystemConfigurator::sdebug field not found\n");

+        return JNI_ERR;

+    }

+    debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);

+    if (debugObj != NULL) {

+        debugCls = (*env)->FindClass(env,"sun/security/util/Debug");

+        if (debugCls == NULL) {

+            printf("libsystemconf: Debug class not found\n");

+            return JNI_ERR;

+        }

+        debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,

+                "println", "(Ljava/lang/String;)V");

+        if (debugPrintlnMethodID == NULL) {

+            printf("libsystemconf: Debug::println(String) method not found\n");

+            return JNI_ERR;

+        }

+        debugObj = (*env)->NewGlobalRef(env, debugObj);

+    }

+

+#ifdef SYSCONF_NSS

+    getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled;

+#else

+    if (loadNSS(env) == JNI_FALSE) {

+      dbgPrint(env, "libsystemconf: Failed to load NSS library.");

+    }

+#endif

+

+    return (*env)->GetVersion(env);

+}

+

+/*

+ * Class:     java_security_SystemConfigurator

+ * Method:    JNI_OnUnload

+ */

+JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)

+{

+    JNIEnv *env;

+

+    if (debugObj != NULL) {

+        if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {

+            return; /* Should not happen */

+        }

+#ifndef SYSCONF_NSS

+        closeNSS(env);

+#endif

+        (*env)->DeleteGlobalRef(env, debugObj);

+    }

+}

+

+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled

+  (JNIEnv *env, jclass cls)

+{

+    int fips_enabled;

+    char msg[MSG_MAX_SIZE];

+    int msg_bytes;

+

+    if (getSystemFIPSEnabled != NULL) {

+      dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");

+      fips_enabled = (*getSystemFIPSEnabled)();

+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \

+                           " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);

+      handle_msg(env, msg, msg_bytes);

+      return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);

+    } else {

+      FILE *fe;

+

+      dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);

+      if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {

+        throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);

+        return JNI_FALSE;

+      }

+      fips_enabled = fgetc(fe);

+      fclose(fe);

+      if (fips_enabled == EOF) {

+        throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);

+        return JNI_FALSE;

+      }

+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \

+                           " read character is '%c'", fips_enabled);

+      handle_msg(env, msg, msg_bytes);

+      return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);

+    }

+}

diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java

index a020e1c15d8..6d459fdec01 100644

--- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java

+++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java

@@ -31,6 +31,7 @@ import java.security.SecureRandom;

 import java.security.PrivilegedAction;

 import java.util.HashMap;

 import java.util.List;

+import jdk.internal.access.SharedSecrets;

 import static sun.security.util.SecurityConstants.PROVIDER_VER;

 import static sun.security.util.SecurityProviderConstants.*;

@@ -78,6 +79,10 @@ import static sun.security.util.SecurityProviderConstants.*;

 public final class SunJCE extends Provider {

+    private static final boolean systemFipsEnabled =

+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()

+            .isSystemFipsEnabled();

+

     @java.io.Serial

     private static final long serialVersionUID = 6812507587804302833L;

@@ -143,285 +148,287 @@ public final class SunJCE extends Provider {

     void putEntries() {

         // reuse attribute map and reset before each reuse

         HashMap<String, String> attrs = new HashMap<>(3);

-        attrs.put("SupportedModes", "ECB");

-        attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"

-                + "|OAEPWITHMD5ANDMGF1PADDING"

-                + "|OAEPWITHSHA1ANDMGF1PADDING"

-                + "|OAEPWITHSHA-1ANDMGF1PADDING"

-                + "|OAEPWITHSHA-224ANDMGF1PADDING"

-                + "|OAEPWITHSHA-256ANDMGF1PADDING"

-                + "|OAEPWITHSHA-384ANDMGF1PADDING"

-                + "|OAEPWITHSHA-512ANDMGF1PADDING"

-                + "|OAEPWITHSHA-512/224ANDMGF1PADDING"

-                + "|OAEPWITHSHA-512/256ANDMGF1PADDING");

-        attrs.put("SupportedKeyClasses",

-                "java.security.interfaces.RSAPublicKey" +

-                "|java.security.interfaces.RSAPrivateKey");

-        ps("Cipher", "RSA",

-                "com.sun.crypto.provider.RSACipher", null, attrs);

-

-        // common block cipher modes, pads

-        final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +

-            "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +

-            "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";

-        final String BLOCK_MODES128 = BLOCK_MODES +

-            "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" +

-            "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128";

-        final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING";

-

-        attrs.clear();

-        attrs.put("SupportedModes", BLOCK_MODES);

-        attrs.put("SupportedPaddings", BLOCK_PADS);

-        attrs.put("SupportedKeyFormats", "RAW");

-        ps("Cipher", "DES",

-                "com.sun.crypto.provider.DESCipher", null, attrs);

-        psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher",

-                attrs);

-        ps("Cipher", "Blowfish",

-                "com.sun.crypto.provider.BlowfishCipher", null, attrs);

-

-        ps("Cipher", "RC2",

-                "com.sun.crypto.provider.RC2Cipher", null, attrs);

-

-        attrs.clear();

-        attrs.put("SupportedModes", BLOCK_MODES128);

-        attrs.put("SupportedPaddings", BLOCK_PADS);

-        attrs.put("SupportedKeyFormats", "RAW");

-        psA("Cipher", "AES",

-                "com.sun.crypto.provider.AESCipher$General", attrs);

-

-        attrs.clear();

-        attrs.put("SupportedKeyFormats", "RAW");

-        psA("Cipher", "AES/KW/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding",

-                attrs);

-        ps("Cipher", "AES/KW/PKCS5Padding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding",

-                null, attrs);

-        psA("Cipher", "AES/KWP/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding",

-                attrs);

-

-        psA("Cipher", "AES_128/ECB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_128/CBC/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding",

-                attrs);

-        psA("Cipher", "AES_128/OFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_128/CFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_128/KW/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding",

-                attrs);

-        ps("Cipher", "AES_128/KW/PKCS5Padding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding",

-                null, attrs);

-        psA("Cipher", "AES_128/KWP/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding",

-                attrs);

-

-        psA("Cipher", "AES_192/ECB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_192/CBC/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding",

-                attrs);

-        psA("Cipher", "AES_192/OFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_192/CFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_192/KW/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding",

-                attrs);

-        ps("Cipher", "AES_192/KW/PKCS5Padding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding",

-                null, attrs);

-        psA("Cipher", "AES_192/KWP/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding",

-                attrs);

-

-        psA("Cipher", "AES_256/ECB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_256/CBC/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding",

-                attrs);

-        psA("Cipher", "AES_256/OFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_256/CFB/NoPadding",

-                "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding",

-                attrs);

-        psA("Cipher", "AES_256/KW/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding",

-                attrs);

-        ps("Cipher", "AES_256/KW/PKCS5Padding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding",

-                null, attrs);

-        psA("Cipher", "AES_256/KWP/NoPadding",

-                "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding",

-                attrs);

-

-        attrs.clear();

-        attrs.put("SupportedModes", "GCM");

-        attrs.put("SupportedKeyFormats", "RAW");

-

-        ps("Cipher", "AES/GCM/NoPadding",

-                "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null,

-                attrs);

-        psA("Cipher", "AES_128/GCM/NoPadding",

-                "com.sun.crypto.provider.GaloisCounterMode$AES128",

-                attrs);

-        psA("Cipher", "AES_192/GCM/NoPadding",

-                "com.sun.crypto.provider.GaloisCounterMode$AES192",

-                attrs);

-        psA("Cipher", "AES_256/GCM/NoPadding",

-                "com.sun.crypto.provider.GaloisCounterMode$AES256",

-                attrs);

-

-        attrs.clear();

-        attrs.put("SupportedModes", "CBC");

-        attrs.put("SupportedPaddings", "NOPADDING");

-        attrs.put("SupportedKeyFormats", "RAW");

-        ps("Cipher", "DESedeWrap",

-                "com.sun.crypto.provider.DESedeWrapCipher", null, attrs);

-

-        attrs.clear();

-        attrs.put("SupportedModes", "ECB");

-        attrs.put("SupportedPaddings", "NOPADDING");

-        attrs.put("SupportedKeyFormats", "RAW");

-        psA("Cipher", "ARCFOUR",

-                "com.sun.crypto.provider.ARCFOURCipher", attrs);

-

-        attrs.clear();

-        attrs.put("SupportedKeyFormats", "RAW");

-        ps("Cipher",  "ChaCha20",

-                "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only",

-                null, attrs);

-        psA("Cipher",  "ChaCha20-Poly1305",

-                "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305",

-                attrs);

-

-        // PBES1

-        psA("Cipher", "PBEWithMD5AndDES",

-                "com.sun.crypto.provider.PBEWithMD5AndDESCipher",

-                null);

-        ps("Cipher", "PBEWithMD5AndTripleDES",

-                "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher");

-        psA("Cipher", "PBEWithSHA1AndDESede",

-                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede",

-                null);

-        psA("Cipher", "PBEWithSHA1AndRC2_40",

-                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40",

-                null);

-        psA("Cipher", "PBEWithSHA1AndRC2_128",

-                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128",

-                null);

-        psA("Cipher", "PBEWithSHA1AndRC4_40",

-                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40",

-                null);

-

-        psA("Cipher", "PBEWithSHA1AndRC4_128",

-                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128",

-                null);

-

-        // PBES2

-        ps("Cipher", "PBEWithHmacSHA1AndAES_128",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128");

-

-        ps("Cipher", "PBEWithHmacSHA224AndAES_128",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128");

-

-        ps("Cipher", "PBEWithHmacSHA256AndAES_128",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128");

-

-        ps("Cipher", "PBEWithHmacSHA384AndAES_128",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128");

-

-        ps("Cipher", "PBEWithHmacSHA512AndAES_128",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128");

-

-        ps("Cipher", "PBEWithHmacSHA1AndAES_256",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256");

-

-        ps("Cipher", "PBEWithHmacSHA224AndAES_256",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256");

-

-        ps("Cipher", "PBEWithHmacSHA256AndAES_256",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256");

-

-        ps("Cipher", "PBEWithHmacSHA384AndAES_256",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256");

-

-        ps("Cipher", "PBEWithHmacSHA512AndAES_256",

-                "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256");

-

-        /*

-         * Key(pair) Generator engines

-         */

-        ps("KeyGenerator", "DES",

-                "com.sun.crypto.provider.DESKeyGenerator");

-        psA("KeyGenerator", "DESede",

-                "com.sun.crypto.provider.DESedeKeyGenerator",

-                null);

-        ps("KeyGenerator", "Blowfish",

-                "com.sun.crypto.provider.BlowfishKeyGenerator");

-        psA("KeyGenerator", "AES",

-                "com.sun.crypto.provider.AESKeyGenerator",

-                null);

-        ps("KeyGenerator", "RC2",

-                "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator");

-        psA("KeyGenerator", "ARCFOUR",

-                "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator",

-                null);

-        ps("KeyGenerator", "ChaCha20",

-                "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator");

-        ps("KeyGenerator", "HmacMD5",

-                "com.sun.crypto.provider.HmacMD5KeyGenerator");

-

-        psA("KeyGenerator", "HmacSHA1",

-                "com.sun.crypto.provider.HmacSHA1KeyGenerator", null);

-        psA("KeyGenerator", "HmacSHA224",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224",

-                null);

-        psA("KeyGenerator", "HmacSHA256",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256",

-                null);

-        psA("KeyGenerator", "HmacSHA384",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384",

-                null);

-        psA("KeyGenerator", "HmacSHA512",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512",

-                null);

-        psA("KeyGenerator", "HmacSHA512/224",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224",

-                null);

-        psA("KeyGenerator", "HmacSHA512/256",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256",

-                null);

-

-        psA("KeyGenerator", "HmacSHA3-224",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224",

-                null);

-        psA("KeyGenerator", "HmacSHA3-256",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256",

-                null);

-        psA("KeyGenerator", "HmacSHA3-384",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384",

-                null);

-        psA("KeyGenerator", "HmacSHA3-512",

-                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512",

-                null);

-

-        psA("KeyPairGenerator", "DiffieHellman",

-                "com.sun.crypto.provider.DHKeyPairGenerator",

-                null);

+        if (!systemFipsEnabled) {

+            attrs.put("SupportedModes", "ECB");

+            attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"

+                    + "|OAEPWITHMD5ANDMGF1PADDING"

+                    + "|OAEPWITHSHA1ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-1ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-224ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-256ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-384ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-512ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-512/224ANDMGF1PADDING"

+                    + "|OAEPWITHSHA-512/256ANDMGF1PADDING");

+            attrs.put("SupportedKeyClasses",

+                    "java.security.interfaces.RSAPublicKey" +

+                    "|java.security.interfaces.RSAPrivateKey");

+            ps("Cipher", "RSA",

+                    "com.sun.crypto.provider.RSACipher", null, attrs);

+

+            // common block cipher modes, pads

+            final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +

+                "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +

+                "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";

+            final String BLOCK_MODES128 = BLOCK_MODES +