[
https://issues.apache.org/jira/browse/WICKET-7190?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105473#comment-18105473
]
ASF subversion and git services commented on WICKET-7190:
---------------------------------------------------------
Commit 33eaf71733eb3bfb2f71b99b618585db95cb69a4 in wicket's branch
refs/heads/document-security-model from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=33eaf71733 ]
WICKET-7190 Update the user guide for the redesigned crypt API
The "URLs encryption in detail" section still described the Wicket 10 crypt API
(some of it already stale before this work). Bring it in line with the redesign:
- ICrypt is shown from its real package org.apache.wicket.core.util.crypt with
the byte-array + URL-safe-String signature and the null-on-failure contract.
- The default implementation is SchemeCrypt (self-describing, authenticated
ciphertext), not SunJceCrypt/PBEWithMD5AndDES. Document the pluggable
ICryptScheme, the default AesGcmCryptScheme (JDK-native AES-256-GCM), the
scheme whitelist / downgrade protection and migration, and the AES-256-GCM-SIV
opt-in (requires Bouncy Castle).
- The default factory is KeyInSessionCryptFactory (was KeyInSessionSunJceCrypt-
Factory); the stateless note now points to ApplicationKeyCryptFactory.
Also drop the outdated warning in the URL chapter that the default cipher "might
not be strong enough for production": the default is now authenticated
AES-256-GCM with a per-session key.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
> Unified cryptography API
> ------------------------
>
> Key: WICKET-7190
> URL: https://issues.apache.org/jira/browse/WICKET-7190
> Project: Wicket
> Issue Type: New Feature
> Components: wicket-core
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
> Fix For: 11.0.0
>
>
> The current cryptography API in Wicket is split over {{ICrypt}} and
> {{ICrypter}}. Both APIs serve a similar purpose but for different subsystems.
> The goal is to unify these APIs and to allow the implementation of more
> modern ciphers, with AEAD support. Also, the documentation on this API and
> its implementations must be improved, clearly stating what it does and what
> it does not deliver.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
