AW: [11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Doerr, Martin]

Hi Paul,

thank you for the review!
I´ll remove the extra blank line before pushing.

Best regards,
Martin


Von: Hohensee, Paul 
Datum: Mittwoch, 12. Mai 2021 um 00:00
An: Doerr, Martin , jdk-updates-...@openjdk.java.net 
, security-dev 
Cc: Langer, Christoph 
Betreff: Re: [11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC 
algorithms
There’s an extra blank line inserted at the end of java.security. Otherwise 
lgtm.

I’m fine with using KnownOIDs.java from tip. One might object that now it’s in 
a different location and must be kept sync’ed with tip, but I don’t agree 
because the backported version must be updated only when a test that needs the 
update is backported, and if that’s needed it’ll be obvious what to do.

Thanks,
Paul

From: security-dev  on behalf of "Doerr, 
Martin" 
Date: Friday, April 30, 2021 at 9:35 AM
To: "jdk-updates-...@openjdk.java.net" , 
security-dev 
Cc: "Langer, Christoph" 
Subject: [11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC 
algorithms

Hi,

JDK-8153005 is backported to 11.0.12-oracle. I'd like to backport it for parity.
It doesn't apply cleanly.

Bug:
https://bugs.openjdk.java.net/browse/JDK-8153005

CSR covering 11u:
https://bugs.openjdk.java.net/browse/JDK-8228481

Original change:
https://github.com/openjdk/jdk/commit/f77a6585

11u rejected hunks:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/8153005_PKCS12_rej.txt

Resolution:
- Regular code is trivial to resolve, but the tests are tricky and the hunks 
were mostly integrated manually.
- Introduce test/lib/jdk/test/lib/KnownOIDs.java as copy from jdk head 
src/java.base/share/classes/sun/security/util/KnownOIDs.java with last change 
from Oct 2020. Put into package jdk.test.lib and using System.out as debug 
output stream. This should make future backports easier, too.
- DerUtils.java: ObjectIdentifier interface is diffent in 11u (different 
constructors).
- Hunks in GenerateAll.java were skipped because the affected code is not in 
11u (JDK-8242068).

11u backport:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/webrev.00/

Please review.

Best regards,
Martin

Re: [11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Hohensee, Paul]

There’s an extra blank line inserted at the end of java.security. Otherwise 
lgtm.

I’m fine with using KnownOIDs.java from tip. One might object that now it’s in 
a different location and must be kept sync’ed with tip, but I don’t agree 
because the backported version must be updated only when a test that needs the 
update is backported, and if that’s needed it’ll be obvious what to do.

Thanks,
Paul

From: security-dev  on behalf of "Doerr, 
Martin" 
Date: Friday, April 30, 2021 at 9:35 AM
To: "jdk-updates-...@openjdk.java.net" , 
security-dev 
Cc: "Langer, Christoph" 
Subject: [11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC 
algorithms

Hi,

JDK-8153005 is backported to 11.0.12-oracle. I'd like to backport it for parity.
It doesn't apply cleanly.

Bug:
https://bugs.openjdk.java.net/browse/JDK-8153005

CSR covering 11u:
https://bugs.openjdk.java.net/browse/JDK-8228481

Original change:
https://github.com/openjdk/jdk/commit/f77a6585

11u rejected hunks:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/8153005_PKCS12_rej.txt

Resolution:
- Regular code is trivial to resolve, but the tests are tricky and the hunks 
were mostly integrated manually.
- Introduce test/lib/jdk/test/lib/KnownOIDs.java as copy from jdk head 
src/java.base/share/classes/sun/security/util/KnownOIDs.java with last change 
from Oct 2020. Put into package jdk.test.lib and using System.out as debug 
output stream. This should make future backports easier, too.
- DerUtils.java: ObjectIdentifier interface is diffent in 11u (different 
constructors).
- Hunks in GenerateAll.java were skipped because the affected code is not in 
11u (JDK-8242068).

11u backport:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/webrev.00/

Please review.

Best regards,
Martin

[11u] RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Doerr, Martin]

Hi,

JDK-8153005 is backported to 11.0.12-oracle. I'd like to backport it for parity.
It doesn't apply cleanly.

Bug:
https://bugs.openjdk.java.net/browse/JDK-8153005

CSR covering 11u:
https://bugs.openjdk.java.net/browse/JDK-8228481

Original change:
https://github.com/openjdk/jdk/commit/f77a6585

11u rejected hunks:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/8153005_PKCS12_rej.txt

Resolution:
- Regular code is trivial to resolve, but the tests are tricky and the hunks 
were mostly integrated manually.
- Introduce test/lib/jdk/test/lib/KnownOIDs.java as copy from jdk head 
src/java.base/share/classes/sun/security/util/KnownOIDs.java with last change 
from Oct 2020. Put into package jdk.test.lib and using System.out as debug 
output stream. This should make future backports easier, too.
- DerUtils.java: ObjectIdentifier interface is diffent in 11u (different 
constructors).
- Hunks in GenerateAll.java were skipped because the affected code is not in 
11u (JDK-8242068).

11u backport:
http://cr.openjdk.java.net/~mdoerr/8153005_PKCS12_11u/webrev.00/

Please review.

Best regards,
Martin

Re: RFR 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Sean Mullan]

On 11/24/20 11:28 AM, Weijun Wang wrote:

Is “keystore.pkcs12.*” better? Or, maybe more clear?

See the security properties starting with `keystore.pkcs12` in the 
`java.security` file for detailed information.


"starting with" should be sufficient, I think. No need for the asterisk.

--Sean



Thanks,
Max


On Nov 24, 2020, at 11:23 AM, Sean Mullan  wrote:

On 11/17/20 4:38 PM, Weijun Wang wrote:

On Apr 10, 2020, at 5:03 AM, Weijun Wang  wrote:

Please take a review at

   CSR : 8228481: Upgrade the default PKCS12 encryption/MAC algorithms
  Release note : https://bugs.openjdk.java.net/browse/JDK-8242069

I forget if the release note has been reviewed before. If not, please take a 
look.


I made a few small wording changes and added "keystore.pkcs12" for the security 
properties to look for more information.

--Sean


Thanks,
Max

webrev : http://cr.openjdk.java.net/~weijun/8153005/webrev.00/

The default pkcs12 algorithms are bumped into PBE and HMAC based on SHA-256 and 
AES-256.

Thanks,
Max

Re: RFR 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

Is “keystore.pkcs12.*” better? Or, maybe more clear?

   See the security properties starting with `keystore.pkcs12` in the 
`java.security` file for detailed information. 

Thanks,
Max

> On Nov 24, 2020, at 11:23 AM, Sean Mullan  wrote:
> 
> On 11/17/20 4:38 PM, Weijun Wang wrote:
>>> On Apr 10, 2020, at 5:03 AM, Weijun Wang  wrote:
>>> 
>>> Please take a review at
>>> 
>>>   CSR : 8228481: Upgrade the default PKCS12 encryption/MAC 
>>> algorithms
>>>  Release note : https://bugs.openjdk.java.net/browse/JDK-8242069
>> I forget if the release note has been reviewed before. If not, please take a 
>> look.
> 
> I made a few small wording changes and added "keystore.pkcs12" for the 
> security properties to look for more information.
> 
> --Sean
> 
>> Thanks,
>> Max
>>>webrev : http://cr.openjdk.java.net/~weijun/8153005/webrev.00/
>>> 
>>> The default pkcs12 algorithms are bumped into PBE and HMAC based on SHA-256 
>>> and AES-256.
>>> 
>>> Thanks,
>>> Max
>>> 

Re: RFR 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Sean Mullan]

On 11/17/20 4:38 PM, Weijun Wang wrote:




On Apr 10, 2020, at 5:03 AM, Weijun Wang  wrote:

Please take a review at

   CSR : 8228481: Upgrade the default PKCS12 encryption/MAC algorithms
  Release note : https://bugs.openjdk.java.net/browse/JDK-8242069



I forget if the release note has been reviewed before. If not, please take a 
look.


I made a few small wording changes and added "keystore.pkcs12" for the 
security properties to look for more information.


--Sean



Thanks,
Max


webrev : http://cr.openjdk.java.net/~weijun/8153005/webrev.00/

The default pkcs12 algorithms are bumped into PBE and HMAC based on SHA-256 and 
AES-256.

Thanks,
Max

Re: RFR 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

> On Apr 10, 2020, at 5:03 AM, Weijun Wang  wrote:
> 
> Please take a review at
> 
>   CSR : 8228481: Upgrade the default PKCS12 encryption/MAC algorithms
>  Release note : https://bugs.openjdk.java.net/browse/JDK-8242069


I forget if the release note has been reviewed before. If not, please take a 
look.

Thanks,
Max

>webrev : http://cr.openjdk.java.net/~weijun/8153005/webrev.00/
> 
> The default pkcs12 algorithms are bumped into PBE and HMAC based on SHA-256 
> and AES-256.
> 
> Thanks,
> Max
> 

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v4]

[Weijun Wang]

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at 
> https://bugs.openjdk.java.net/browse/JDK-8228481.

Weijun Wang has updated the pull request with a new target base due to a merge 
or a rebase. The incremental webrev excludes the unrelated changes brought in 
by the merge/rebase. The pull request contains five additional commits since 
the last revision:

 - simplify test
 - merge
 - update README and exclude README
 - change ic to 1
 - 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

-

Changes:
  - all: https://git.openjdk.java.net/jdk/pull/473/files
  - new: https://git.openjdk.java.net/jdk/pull/473/files/41be78aa..31a22fd4

Webrevs:
 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=03
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=02-03

  Stats: 401475 lines in 1918 files changed: 365145 ins; 23887 del; 12443 mod
  Patch: https://git.openjdk.java.net/jdk/pull/473.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/473/head:pull/473

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v3]

[Sean Mullan]

On Fri, 9 Oct 2020 01:33:38 GMT, Weijun Wang  wrote:

>> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
>> Please also review the CSR at 
>> https://bugs.openjdk.java.net/browse/JDK-8228481.
>
> Weijun Wang has updated the pull request incrementally with one additional 
> commit since the last revision:
> 
>   update README and exclude README

Marked as reviewed by mullan (Reviewer).

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v3]

[Weijun Wang]

On Fri, 9 Oct 2020 00:07:39 GMT, Weijun Wang  wrote:

>> I tried but cannot find a way to tell if a system is Windows Server 2016 or 
>> 2019. Their os.version is all 10.0. I've
>> filed an enhancement at https://bugs.openjdk.java.net/browse/JDK-8254241 for 
>> it. That said, I did try running the test
>> on a Windows Server 2019 using new algorithms and it succeeds.
>
> There are existing tests reading openssl generated pkcs12 files in
> https://github.com/openjdk/jdk/tree/master/test/jdk/sun/security/pkcs12/params,
>  it already contains files using both
> weak and strong algorithms.

Update `params/README`, exclude it from the de-BASE64 list (don't know it 
succeeded) in the `ParamsTest.java` test.
Also remove a useless call in the test.

Thinking about adding a benchmark, but it will be in another commit.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v3]

[Weijun Wang]

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

Weijun Wang has updated the pull request incrementally with one additional 
commit since the last revision:

  update README and exclude README

-

Changes:
  - all: https://git.openjdk.java.net/jdk/pull/473/files
  - new: https://git.openjdk.java.net/jdk/pull/473/files/6b5c5b5e..41be78aa

Webrevs:
 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=02
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=01-02

  Stats: 39 lines in 2 files changed: 7 ins; 6 del; 26 mod
  Patch: https://git.openjdk.java.net/jdk/pull/473.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/473/head:pull/473

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v2]

[Weijun Wang]

On Fri, 9 Oct 2020 00:04:17 GMT, Weijun Wang  wrote:

>> Are you still planning, or is it possible to add a test for Windows 2019? 
>> Also, have you considered adding a test that
>> checks if the JDK can read OpenSSL PKCS#12 files and vice versa? Maybe we 
>> can do that later as a follow-on issue.
>> Otherwise, I will approve.
>
> I tried but cannot find a way to tell if a system is Windows Server 2016 or 
> 2019. Their os.version is all 10.0. I've
> filed an enhancement at https://bugs.openjdk.java.net/browse/JDK-8254241 for 
> it. That said, I did try running the test
> on a Windows Server 2019 using new algorithms and it succeeds.

There are existing tests reading openssl generated pkcs12 files in
https://github.com/openjdk/jdk/tree/master/test/jdk/sun/security/pkcs12/params, 
but I can add a new one using strong
algorithms.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v2]

[Weijun Wang]

On Thu, 8 Oct 2020 16:34:59 GMT, Sean Mullan  wrote:

>> New commit updating ic to 1. I also created separate constants for 
>> DEFAULT_CERT_PBE_ITERATION_COUNT and
>> DEFAULT_KEY_PBE_ITERATION_COUNT. I haven't made the change for 
>> LEGACY_PBE_ITERATION_COUNT since they will never change.
>
> Are you still planning, or is it possible to add a test for Windows 2019? 
> Also, have you considered adding a test that
> checks if the JDK can read OpenSSL PKCS#12 files and vice versa? Maybe we can 
> do that later as a follow-on issue.
> Otherwise, I will approve.

I tried but cannot find a way to tell if a system is Windows Server 2016 or 
2019. Their os.version is all 10.0. I've
filed an enhancement for it. That said, I did try running the test using new 
algorithms and it succeeds.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v2]

[Sean Mullan]

On Thu, 8 Oct 2020 14:21:09 GMT, Weijun Wang  wrote:

>> CSR updated. More description, and iteration counts lowered to 1. Will 
>> update code soon.
>
> New commit updating ic to 1. I also created separate constants for 
> DEFAULT_CERT_PBE_ITERATION_COUNT and
> DEFAULT_KEY_PBE_ITERATION_COUNT. I haven't made the change for 
> LEGACY_PBE_ITERATION_COUNT since they will never change.

Are you still planning, or is it possible to add a test for Windows 2019? Also, 
have you considered adding a test that
checks if the JDK can read OpenSSL PKCS#12 files and vice versa? Maybe we can 
do that later as a follow-on issue.
Otherwise, I will approve.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v2]

[Weijun Wang]

On Wed, 7 Oct 2020 22:49:09 GMT, Weijun Wang  wrote:

>> CSR looks good. In "Sepcification" section: a typo in 'Thr iteration counts 
>> used by'. At the end, it describes the new
>> system property will override the security properties and use the older and 
>> weaker algorithms, so suggest we could also
>> add text about setting the iteration counts to the default legacy values.
>
> CSR updated. More description, and iteration counts lowered to 1. Will 
> update code soon.

New commit updating ic to 1. I also created separate constants for 
DEFAULT_CERT_PBE_ITERATION_COUNT and
DEFAULT_KEY_PBE_ITERATION_COUNT. I haven't made the change for 
LEGACY_PBE_ITERATION_COUNT since they will never change.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms [v2]

[Weijun Wang]

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

Weijun Wang has updated the pull request incrementally with one additional 
commit since the last revision:

  change ic to 1

-

Changes:
  - all: https://git.openjdk.java.net/jdk/pull/473/files
  - new: https://git.openjdk.java.net/jdk/pull/473/files/b99611b3..6b5c5b5e

Webrevs:
 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=01
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=00-01

  Stats: 52 lines in 5 files changed: 1 ins; 1 del; 50 mod
  Patch: https://git.openjdk.java.net/jdk/pull/473.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/473/head:pull/473

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Hai-May Chao]

On Wed, 7 Oct 2020 22:08:19 GMT, Hai-May Chao  wrote:

>> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
>> Please also review the CSR at
>> https://bugs.openjdk.java.net/browse/JDK-8228481.
>
> Looks good. Only minor comments.

CSR looks good. In "Sepcification" section: a typo in 'Thr iteration counts 
used by'. At the end, it describes the new
system property will override the security properties and use the older and 
weaker algorithms, so suggest we could also
add text about setting the iteration counts to the default legacy values.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

On Wed, 7 Oct 2020 22:20:07 GMT, Hai-May Chao  wrote:

>> Looks good. Only minor comments.
>
> CSR looks good. In "Sepcification" section: a typo in 'Thr iteration counts 
> used by'. At the end, it describes the new
> system property will override the security properties and use the older and 
> weaker algorithms, so suggest we could also
> add text about setting the iteration counts to the default legacy values.

CSR updated. More description, and iteration counts lowered to 1. Will 
update code soon.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Hai-May Chao]

On Thu, 1 Oct 2020 20:02:34 GMT, Weijun Wang  wrote:

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

Looks good. Only minor comments.

src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java line 103:

> 101: = "PBEWithHmacSHA256AndAES_256";
> 102: private static final String DEFAULT_MAC_ALGORITHM = "HmacPBESHA256";
> 103: private static final int DEFAULT_PBE_ITERATION_COUNT = 5;

As we have keystore.pkcs12.certPbeIterationCount and 
keystore.pkcs12.keyPbeIterationCount, I would like to suggest that
we can define DEFAULT_CERT_PBE_ITERATION_COUNT and 
DEFAULT_KEY_PBE_ITERATION_COUNT, specifying each of the values for
finer granularity. Same for LEGACY_PBE_ITERATION_COUNT.

test/jdk/sun/security/mscapi/VeryLongAlias.java line 48:

> 46:
> 47: static String alias = String.format("%0512d", new 
> Random().nextInt(10));
> 48:

Add bug number to @bug.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

On Wed, 7 Oct 2020 22:06:28 GMT, Hai-May Chao  wrote:

>> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
>> Please also review the CSR at
>> https://bugs.openjdk.java.net/browse/JDK-8228481.
>
> test/jdk/sun/security/mscapi/VeryLongAlias.java line 48:
> 
>> 46:
>> 47: static String alias = String.format("%0512d", new 
>> Random().nextInt(10));
>> 48:
> 
> Add bug number to @bug.

OK.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

On Tue, 6 Oct 2020 18:34:34 GMT, Sean Mullan  wrote:

>> I only know Windows Server 2019 can accept the new algorithms.
>
> Ok, but maybe we can split this test in two and use the jtreg @requires tag 
> to run the newer algorithms on Windows
> Server 2019? It would be a useful test if this is the only test where we test 
> PKCS12 interop with Windows.

OK. Or I can see if there is an existing method in test/lib that can detects 
the version.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Sean Mullan]

On Fri, 2 Oct 2020 19:07:20 GMT, Weijun Wang  wrote:

>> test/jdk/sun/security/mscapi/VeryLongAlias.java line 51:
>> 
>>> 49: public static void main(String[] args) throws Throwable {
>>> 50:
>>> 51: // Using the old algorithms to make sure the file is recognized
>> 
>> Do we also want to have a test that uses the new algorithms?
>
> I only know Windows Server 2019 can accept the new algorithms.

Ok, but maybe we can split this test in two and use the jtreg @requires tag to 
run the newer algorithms on Windows
Server 2019? It would be a useful test if this is the only test where we test 
PKCS12 interop with Windows.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

On Fri, 2 Oct 2020 18:44:48 GMT, Sean Mullan  wrote:

>> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
>> Please also review the CSR at
>> https://bugs.openjdk.java.net/browse/JDK-8228481.
>
> test/jdk/sun/security/mscapi/VeryLongAlias.java line 51:
> 
>> 49: public static void main(String[] args) throws Throwable {
>> 50:
>> 51: // Using the old algorithms to make sure the file is recognized
> 
> Do we also want to have a test that uses the new algorithms?

I only know Windows Server 2019 can accept the new algorithms.

> test/lib/jdk/test/lib/security/DerUtils.java line 1:
> 
>> 1: /*
> 
> Is this test change supposed to be a part of this fix?

Yes, the change simplifies `checkAlg` calls so they don't need to convert 
`KnownOIDs` or `String` to `ObjectIdentifier`
first.

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Sean Mullan]

On Thu, 1 Oct 2020 20:02:34 GMT, Weijun Wang  wrote:

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

test/lib/jdk/test/lib/security/DerUtils.java line 1:

> 1: /*

Is this test change supposed to be a part of this fix?

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Sean Mullan]

On Thu, 1 Oct 2020 20:02:34 GMT, Weijun Wang  wrote:

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

test/jdk/sun/security/mscapi/VeryLongAlias.java line 51:

> 49: public static void main(String[] args) throws Throwable {
> 50:
> 51: // Using the old algorithms to make sure the file is recognized

Do we also want to have a test that uses the new algorithms?

-

PR: https://git.openjdk.java.net/jdk/pull/473

Re: RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

On Thu, 1 Oct 2020 20:02:34 GMT, Weijun Wang  wrote:

> Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
> Please also review the CSR at
> https://bugs.openjdk.java.net/browse/JDK-8228481.

TBD: We bumped iteration counts for PBE and HMAC to 5 and 10 when we 
were using weak algorithms. Now that the
algorithms are strong, we can consider lower them. Currently, openssl 3.0.0 
uses 2048 and Windows Server 2019 uses 2000.

-

PR: https://git.openjdk.java.net/jdk/pull/473

RFR: 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

Default algorithms are bumped to be based on PBES2 with AES-256 and SHA-256. 
Please also review the CSR at
https://bugs.openjdk.java.net/browse/JDK-8228481.

-

Commit messages:
 - 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

Changes: https://git.openjdk.java.net/jdk/pull/473/files
 Webrev: https://webrevs.openjdk.java.net/?repo=jdk&pr=473&range=00
  Issue: https://bugs.openjdk.java.net/browse/JDK-8153005
  Stats: 445 lines in 6 files changed: 170 ins; 103 del; 172 mod
  Patch: https://git.openjdk.java.net/jdk/pull/473.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/473/head:pull/473

PR: https://git.openjdk.java.net/jdk/pull/473

RFR 8153005: Upgrade the default PKCS12 encryption/MAC algorithms

[Weijun Wang]

Please take a review at

   CSR : 8228481: Upgrade the default PKCS12 encryption/MAC algorithms
  Release note : https://bugs.openjdk.java.net/browse/JDK-8242069
webrev : http://cr.openjdk.java.net/~weijun/8153005/webrev.00/

The default pkcs12 algorithms are bumped into PBE and HMAC based on SHA-256 and 
AES-256.

Thanks,
Max