Re: Design review: JEP 273: DRBG-Based SecureRandom Implementations

2015-11-20 Thread Wang Weijun
> On Nov 21, 2015, at 6:46 AM, Anthony Scarpino > wrote: > > On 11/18/2015 05:32 AM, Sean Mullan wrote: >> The getInstance methods can now take a SecureRandomParameterSpec object >> (rather than an AlgorithmParameterSpec). They should throw >> InvalidAlgorithmParameterException (not IllegalArgu

Re: Design review: JEP 273: DRBG-Based SecureRandom Implementations

2015-11-20 Thread Anthony Scarpino
On 11/18/2015 05:32 AM, Sean Mullan wrote: The getInstance methods can now take a SecureRandomParameterSpec object (rather than an AlgorithmParameterSpec). They should throw InvalidAlgorithmParameterException (not IllegalArgumentException) if the parameters are null or not the right type to be co

Re: RFR 8130132: jarsigner should emit warning if weak algorithms or keysizes are used

2015-11-20 Thread Sean Mullan
This looks good, just a few comments: KeyStoreUtil: 79 if (!ca.getSubjectDN().equals(end.getIssuerDN())) { Use getSubjectX500Principal instead of getSubjectDN as the DN matching algorithm is more precise. Resources: 246 "The %1$s algorithm used as %2$s is considered

openjdk 8 & 2048 bit DSA xml signing

2015-11-20 Thread Basabendra Misra
Hi, It seems there is a fix to support 2048 bit DSA signing in upcoming openjdk 9 release. However , could anyone please guide me what would be the safest way to incorporate the same in openjdk 8? Would really appreciate any help. We're stuck because some CA not offering 1024 bit DSA keys anymore.

Re: JEP260 -- Impact on SunPKCS11?

2015-11-20 Thread Glen Vermeylen
The xml just contains the literal contents of the .cfg file, we then pass this string through a ByteArrayInputstream to the constructor, like following sample code: final String pkcs11Config = "name=eIDCard\nlibrary=C:/Windows/System32/beidpkcs11.dll" + "\nslotListIndex=0" + "

Re: Design review: JEP 273: DRBG-Based SecureRandom Implementations

2015-11-20 Thread Sean Mullan
On 11/19/2015 07:23 PM, Wang Weijun wrote: On Nov 20, 2015, at 1:11 AM, Sean Mullan wrote: >> >>However, I cannot get it working, and I found difficulties understanding the EngineDescription inner class inside Provider.java. >> >>1. For each engine that can take an extra parameter (not provide