RE: [9] RFR: 8141039: Test Task: Develop new tests for JEP 273: DRBG-Based SecureRandom Implementations

Hi Max, Please find the updated webrev: http://cr.openjdk.java.net/~ssahoo/8141039/webrev.02/ The changes includes, - ApiTest.java : Removed printing unnecessary message inside checkException() method. - GetInstanceTest.java - Moved the test back into " java/security/SecureRandom/ ".

Result: New Security Group Member: Jamil Nimeh

The vote for Jamil Nimeh [1] is now closed. Yes: 7 Veto: 0 Abstain: 0 According to the Bylaws definition of Lazy Consensus, this is sufficient to approve the nomination. Sean Mullan [1] http://mail.openjdk.java.net/pipermail/security-dev/2016-April/013781.html

Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

Hi, Please review this test update: http://cr.openjdk.java.net/~xuelei/8157035/webrev.00/ test/javax/net/ssl/etc/keystore and truststore are used a lot for X.509 cert based SSL/TLS authentication in JDK testing. MD5 and SHA1 are used as the signature algorithms. The key size of EC certs is 19

Re: [9] RFR: 8141039: Test Task: Develop new tests for JEP 273: DRBG-Based SecureRandom Implementations

Sorry, I might be not clear enough about the usage of MoreDrbgParameters and securerandom.drbg.config. You are still using MoreDrbgParameters in ApiTest.java. For example, 131 SecureRandomParameters mParam = new MoreDrbgParameters( 132 null, mech

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

I downloaded the files and they match what you described below. Can you please added a text file describing how they are generated. Also, I see a unknown_keystore in the same directory still using the weak algorithms. Do you also intent to update it? Thanks Max > On May 16, 2016, at 8:52 PM, X

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

On 5/16/2016 9:13 PM, Wang Weijun wrote: > I downloaded the files and they match what you described below. > > Can you please added a text file describing how they are generated. The generation is straightforward with keytool. May not need an additional text file any more. > Also, I see a unknow

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

> On May 16, 2016, at 9:34 PM, Xuelei Fan wrote: > > On 5/16/2016 9:13 PM, Wang Weijun wrote: >> I downloaded the files and they match what you described below. >> >> Can you please added a text file describing how they are generated. > The generation is straightforward with keytool. May not n

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

On 5/16/2016 10:24 PM, Wang Weijun wrote: >> > On May 16, 2016, at 9:34 PM, Xuelei Fan wrote: >> > >> > On 5/16/2016 9:13 PM, Wang Weijun wrote: >>> >> I downloaded the files and they match what you described below. >>> >> >>> >> Can you please added a text file describing how they are generated

RFR 8138766: New default -sigalg for keytool

Please take a look at http://cr.openjdk.java.net/~weijun/8138766/webrev.00/ Now both jarsigner and keytool use AlgorithmId::getDefaultSigAlgForKey to decide what the default sigalg should be. Thanks Max

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

Update the README with more information about the stores. http://cr.openjdk.java.net/~xuelei/8157035/webrev.02/ Thanks, Xuelei On 5/16/2016 10:37 PM, Xuelei Fan wrote: > On 5/16/2016 10:24 PM, Wang Weijun wrote: On May 16, 2016, at 9:34 PM, Xuelei Fan wrote: On 5/16/2016 9:13 P

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

You mentioned hacked keytool. So the X.509 v3 certs cannot be used? Thanks Max > On May 17, 2016, at 11:44 AM, Xuelei Fan wrote: > > Update the README with more information about the stores. > http://cr.openjdk.java.net/~xuelei/8157035/webrev.02/ > > Thanks, > Xuelei > > On 5/16/2016 10:37 P

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

On 5/17/2016 11:50 AM, Wang Weijun wrote: > You mentioned hacked keytool. So the X.509 v3 certs cannot be used? > In order to simplify the update (as less update as possible), I would like to keep the root certs version 1 although most of the test case should accept version 3. BTW, it would be ni

Re: Code Review Request of JDK-8157035 Use stronger algorithms and keys for JSSE testing

OK, it's fine. Please go on. > On May 17, 2016, at 12:03 PM, Xuelei Fan wrote: > > On 5/17/2016 11:50 AM, Wang Weijun wrote: >> You mentioned hacked keytool. So the X.509 v3 certs cannot be used? >> > In order to simplify the update (as less update as possible), I would > like to keep the root

Support version 1 cert generation

Hi, Keytool used to generate version 1 self-signed certificates. Now it is mandatory to be version 3. Default version 3 should be OK. However, in some circumstances (for example for testing purpose), version 1 self-signed certificate may still be useful. It would be a low priority, but may be

Re: Support version 1 cert generation

https://bugs.openjdk.java.net/browse/JDK-8157109 filed. --Max > On May 17, 2016, at 12:25 PM, Xuelei Fan wrote: > > Hi, > > Keytool used to generate version 1 self-signed certificates. Now it is > mandatory to be version 3. Default version 3 should be OK. However, in > some circumstances (f

Re: [9] RFR(S): 8067648: JVM crashes reproducable with GCM cipher suites in GCTR doFinal

Hi, On 05/14/2016 08:11 PM, Yozons wrote: Has this fix been incorporated in a release yet? If so, which one? Thanks! I think it's out with 8u60. Best regards, Zoltan -- View this message in context: http://openjdk.5641.n7.nabble.com/9-RFR-S-8067648-JVM-crashes-reproducable-with-GC