On Mon, 29 Sep 2025 21:25:42 GMT, Weijun Wang <[email protected]> wrote:

> `Mac.PBEWithHmacSHA256` is not used because inside its SunJCE implementation 
> the PBKDF2 key length is hardcoded to the Hmac's _block_ length. On the other 
> hand, in PKCS12's PBMAC1, the key length SHOULD be the _output_ length of 
> Hmac.

Makes sense, thanks for the explanation; I rechecked the code and found the two 
differing `PBEKeySpec` constructions.

-------------

PR Comment: https://git.openjdk.org/jdk/pull/24429#issuecomment-3352890070

Reply via email to