When installing Oracle JRE, this is an easy way out, here are the instructions if you want to use OpenJDK Zero VM specifically, be it with Maven, SSL, the ECDH key, or any other cryptographic method that is implemented in the native code in the OpenJDK default encryption service.
I assumed that the ECDHKeyAgreement.deriveKey method fails because it is a native method, and the OpenJDK Zero VM, as it is packaged in Ubuntu for the Raspberry Pi, simply cannot handle it; I am not able to debug this failure.
Ubuntu ships the cryptographic provider BouncyCastle, which is implemented in pure Java. You need to install it in the usual way:
sudo apt install libbcprov-java*
(it also sets documents)
Then follow the instructions in /usr/share/doc/libbcprov-java/README.Debian to make it the default crypto provider. In particular, you need to make a link to the supplier banner from the ext directory from the JRE, so do update-java-alternatives -l , which follows (in my case, I used the default settings specified in Ubuntu 16.04 Raspberry Pi server install - the specific JRE directory may change over time):
sudo ln -s /usr/share/java/bcprov.jar /usr/lib/jvm/java-1.8.0-openjdk-armhf/jre/lib/ext/bcprov.jar
Then edit the file /usr/lib/jvm/java-1.8.0-openjdk-armhf/jre/lib/security/java.security (call the sudo editor) by adding the line:
security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider
... which lists cryptography providers and adding 1 to the priority of existing ones, so the list looks something like this:
security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider security.provider.2=sun.security.provider.Sun security.provider.3=sun.security.rsa.SunRsaSign security.provider.4=sun.security.ec.SunEC security.provider.5=com.sun.net.ssl.internal.ssl.Provider security.provider.6=com.sun.crypto.provider.SunJCE security.provider.7=sun.security.jgss.SunProvider security.provider.8=com.sun.security.sasl.Provider security.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI security.provider.10=sun.security.smartcardio.SunPCSC
Crypto in Java should now work, albeit very slowly. Here is an example of a program that I used to confirm that this is the case if you do not want to use Maven for this:
import java.io.InputStream; import java.net.URL; import java.net.URLConnection; public class URLGet { public static void main(String[] args) { try { URL url = new URL(args[0]); URLConnection urlConnection = url.openConnection(); try ( InputStream stream = urlConnection.getInputStream(); ) { byte[] buf = new byte[4096]; int read; while ((read = stream.read(buf, 0, buf.length)) > 0) { System.out.write(buf, 0, read); } } } catch (Exception e) { e.printStackTrace(System.err); } } }
Point it to any https URL (e.g. java URLGet https://www.google.com/ ) to confirm that Java can handle SSL.