On Fri, 11 Sep 2026 21:01:42 GMT, Artur Barashev <[email protected]> wrote:
>> Hai-May Chao has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> Updated with Artur's comments
>
> src/java.base/share/classes/sun/security/ssl/SignatureScheme.java line 51:
>
>> 49: MLDSA65 (0x0905, "mldsa65", "ML-DSA-65",
>> 50: "ML-DSA",
>> 51: ProtocolVersion.PROTOCOLS_OF_13),
>
> We currently don't test that ML-DSA is filtered from TLS 1.2. Such test can
> be constructed using the existing `AbstractCheckSignatureSchemes` framework.
Added new test `MLDSANotAllowedInTLS12.java`.
> test/jdk/sun/security/ssl/SignatureScheme/MLDSACertSignSchemeConstraint.java
> line 117:
>
>> 115: Security.setProperty("jdk.tls.disabledAlgorithms",
>> 116:
>> Security.getProperty("jdk.tls.disabledAlgorithms")
>> 117: + ", mldsa65 usage certificateSignature");
>
> I suggest to add a few test cases for `HandshakeSignature` usage as well.
Added test cases for `HandshakeSignature` usage to
`MLDSACertSignSchemeConstraint.java`.
> test/jdk/sun/security/ssl/SignatureScheme/MLDSACertSignSchemeConstraint.java
> line 132:
>
>> 130: }
>> 131: System.out.println("Expected SSLHandshakeException: "
>> 132: + e.getMessage());
>
> We can assert that the exception message equals `(handshake_failure) No
> available authentication scheme`
Updated with assertEquals.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r4023896799
PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r4023895949
PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r4023896445
