[11] RFR: JDK-8205111: Develop new Test to verify different key types for supported TLS protocols.

2018-06-20 Thread Sibabrata Sahoo
Hi Xuelei, Please review the patch for, JBS: https://bugs.openjdk.java.net/browse/JDK-8205111 Webrev: http://cr.openjdk.java.net/~ssahoo/8205111/webrev.00/ Change: This Test file verifies all TLS protocols with the supported keytypes. Thanks, Siba

Re: Code Review Request: TLS 1.3 Implementation

2018-06-20 Thread Valerie Peng
Hi Xuelei, - line 2, why is the copyright year changed from 2015 only to 2003 and 2018? Don't we normally preserve the first year and only update/add the second year? - line 110, instead of erroring out, I wonder if it's better to call createPossessions(handshakeContext) and only error out if

Re: RFR [11] CSR for "Add Brainpool ECC support (RFC 5639)"

2018-06-20 Thread Valerie Peng
Are you asking about CSR or existing bug for including Brainpool support in TLS? I saw some bugs which mentions errors/exceptions which brainpool is used, e.g. JSSE has https://bugs.openjdk.java.net/browse/JDK-7189107, key tool has https://bugs.openjdk.java.net/browse/JDK-8201290. After this

Re: RFR CSR 8205446: Add RSASSA-PSS Signature support to SunMSCAPI

2018-06-20 Thread Weijun Wang
All done. I cannot find a JDK 11 docset and I updated it to 10. Thanks Max > On Jun 21, 2018, at 6:56 AM, Bradford Wetmore > wrote: > > > > On 6/20/2018 3:49 PM, Weijun Wang wrote: > > Please review the CSR at > > https://bugs.openjdk.java.net/browse/JDK-8205446. > > Without RSASSA-PSS on Wi

Re: RFR CSR 8205446: Add RSASSA-PSS Signature support to SunMSCAPI

2018-06-20 Thread Bradford Wetmore
On 6/20/2018 3:49 PM, Weijun Wang wrote: > Please review the CSR at > https://bugs.openjdk.java.net/browse/JDK-8205446. > With RSASSA-PSS on Windows, TLS 1.3 is not complete. In JDK-8205445, do you want to updated to include v2.2 as well like you did in the CSR? JDK-8205446: stored inside W

Re: RFR CSR 8205446: Add RSASSA-PSS Signature support to SunMSCAPI

2018-06-20 Thread Weijun Wang
Oops, I meant "without it TLS 1.3 is not complete". > On Jun 21, 2018, at 6:49 AM, Weijun Wang wrote: > > Please review the CSR at https://bugs.openjdk.java.net/browse/JDK-8205446. > With RSASSA-PSS on Windows, TLS 1.3 is not complete. > > Thanks > Max >

Re: RFR [11] CSR for "Add Brainpool ECC support (RFC 5639)"

2018-06-20 Thread Valerie Peng
Yes, I suppose so. I'd also incline to leave out the smaller curves. Basing on the latest patch from Tobias, it does not have the 160/192/224 curves.Valerie On 6/20/2018 3:29 PM, Bradford Wetmore wrote: I see you left out the smaller curves (160/192/224).  The discussion between Adam/Tobia

Re: Code Review Request: TLS 1.3 Implementation

2018-06-20 Thread Valerie Peng
On 6/20/2018 9:58 AM, Xuelei Fan wrote: On 6/19/2018 7:07 PM, Valerie Peng wrote: Hi Xuelei, These look fine. - kind of strange to see SSLKeyAgreement extends SSLKeyAgreementGenerator... Normally, the naming convention implies one generates the other. The name should be more

RFR CSR 8205446: Add RSASSA-PSS Signature support to SunMSCAPI

2018-06-20 Thread Weijun Wang
Please review the CSR at https://bugs.openjdk.java.net/browse/JDK-8205446. With RSASSA-PSS on Windows, TLS 1.3 is not complete. Thanks Max

Re: RFR [11] CSR for "Add Brainpool ECC support (RFC 5639)"

2018-06-20 Thread Bradford Wetmore
I see you left out the smaller curves (160/192/224). The discussion between Adam/Tobias varied between leaving them out and including, I'm guessing there was no compelling reason to include? Brad On 6/15/2018 1:08 PM, Valerie Peng wrote: Hi Can someone help reviewing the CSR for Adding Bra

Re: RFC: Add new JCA provider to support hardware RNGs

2018-06-20 Thread Bernd Eckenfels
Just a FYI under Linux when you read from urandom the Linux kernel will always XOR with random bytes generated with x64 rdrand instruction (arch_get_random_lomg() - if supported). Since it is a XOR it does not have to trust the quality of this black box hardware implementation. I would not impl

Re: Code Review Request: TLS 1.3 Implementation

2018-06-20 Thread Xuelei Fan
On 6/19/2018 7:07 PM, Valerie Peng wrote: Hi Xuelei, These look fine. - kind of strange to see SSLKeyAgreement extends SSLKeyAgreementGenerator... Normally, the naming convention implies one generates the other. The name should be more like SSLKeyAgreementKeyDerivationGenerator. I

Re: Code Review Request: TLS 1.3 Implementation

2018-06-20 Thread Xuelei Fan
Update: http://hg.openjdk.java.net/jdk/sandbox/rev/1cc2f6afa943 On 6/19/2018 12:19 PM, Valerie Peng wrote: Hi Xuelei, Just questions and some nits. looks good looks good - line 98: for unsupported digest, maybe we should consider throw exceptions. It's easier to find out where the suppor