This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new db6f028c45 Update default encryptionAlgorithm to "AES/GCM/NoPadding"
db6f028c45 is described below
commit db6f028c458a76f5708eb06af497fe2a55f24072
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Jul 7 12:04:25 2026 +0100
Update default encryptionAlgorithm to "AES/GCM/NoPadding"
---
.../catalina/tribes/group/interceptors/EncryptInterceptor.java | 5 ++---
webapps/docs/changelog.xml | 9 +++++++++
webapps/docs/config/cluster-interceptor.xml | 5 ++---
3 files changed, 13 insertions(+), 6 deletions(-)
diff --git
a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
index 1712f4cf90..493406de24 100644
--- a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
+++ b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
@@ -62,7 +62,7 @@ public class EncryptInterceptor extends
ChannelInterceptorBase implements Encryp
*/
protected static final StringManager sm =
StringManager.getManager(EncryptInterceptor.class);
- private static final String DEFAULT_ENCRYPTION_ALGORITHM =
"AES/CBC/PKCS5Padding";
+ private static final String DEFAULT_ENCRYPTION_ALGORITHM =
"AES/GCM/NoPadding";
private String providerName;
private String encryptionAlgorithm = DEFAULT_ENCRYPTION_ALGORITHM;
@@ -186,8 +186,7 @@ public class EncryptInterceptor extends
ChannelInterceptorBase implements Encryp
* Sets the encryption algorithm to be used for encrypting and decrypting
channel messages. You must specify the
* <code>algorithm/mode/padding</code>. Information on standard algorithm
names may be found in the
* <a
href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html";>Java
- * documentation</a>. Default is <code>AES/CBC/PKCS5Padding</code> for
backwards compatibility but it is recommended
- * that <code>AES/GCM/NoPadding</code> is used.
+ * documentation</a>. Default is <code>AES/GCM/NoPadding</code>.
*
* @param algorithm The algorithm to use.
*/
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 0a8822c969..b1e0fc4920 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -124,6 +124,15 @@
</update>
</changelog>
</subsection>
+ <subsection name="Cluster">
+ <changelog>
+ <add>
+ Change the default <code>encryptionAlgorithm</code> for the
+ <code>EncryptInterceptor</code> to <code>AES/GCM/NoPadding</code>. This
+ is a breaking change for the <code>EncryptInterceptor</code>. (markt)
+ </add>
+ </changelog>
+ </subsection>
</section>
<section name="Tomcat 11.0.24 (markt)" rtext="release in progress">
<subsection name="Catalina">
diff --git a/webapps/docs/config/cluster-interceptor.xml
b/webapps/docs/config/cluster-interceptor.xml
index 16695586c0..e5834d3958 100644
--- a/webapps/docs/config/cluster-interceptor.xml
+++ b/webapps/docs/config/cluster-interceptor.xml
@@ -260,9 +260,8 @@
<p>The length of the key will specify the flavor of the encryption
algorithm to be used, if applicable (e.g. AES-128 versus AES-256).</p>
- <p>The default algorithm is <code>AES/CBC/PKCS5Padding</code> for
- backwards compatability but it is recommended that
- <code>AES/GCM/NoPadding</code> is used.</p>
+ <p>If not specified, the default algorithm is
+ <code>AES/GCM/NoPadding</code>.</p>
</attribute>
<attribute name="encryptionKey" required="true">
<p>The key to be used with the encryption algorithm.</p>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
