Re: RFR: 8274471: Verification of OCSP Response signed with RSASSA-PSS fails [v2]

2021-09-30 Thread Weijun Wang
> Extra parameters need to be set for RSASSA-PSS signatures. We already have a > helper method for that. > > Some other cleanups: > 1. When using GET for OCSP, make sure no double slash. > 2. Several throws clauses are not necessary. > > No regression test. OCSP needs to access an external serve

Re: RFR: 8274471: Verification of OCSP Response signed with RSASSA-PSS fails

2021-09-30 Thread Weijun Wang
On Thu, 30 Sep 2021 23:15:33 GMT, Hai-May Chao wrote: > As throwing ProviderException is removed from initVerifyWithParam(), could we > remove the ProviderException in the try-catch block from the callers of > initVerifyWithParam()? For example, one of the callers at: > https://github.com/openj

Re: RFR: 8264849: Add KW and KWP support to PKCS11 provider

2021-09-30 Thread Anthony Scarpino
On Fri, 17 Sep 2021 23:22:21 GMT, Valerie Peng wrote: > Anyone has time to review this RFE for adding AES cipher with KW, KWP modes > support to SunPKCS11 provider? > > The main changes are in only one new class, i.e. P11KeyWrapCipher.java, which > is the CipherSpi impl for the native PKCS11 k

Re: RFR: 8274471: Verification of OCSP Response signed with RSASSA-PSS fails

2021-09-30 Thread Hai-May Chao
On Thu, 30 Sep 2021 15:44:32 GMT, Weijun Wang wrote: > Extra parameters need to be set for RSASSA-PSS signatures. We already have a > helper method for that. > > Some other cleanups: > 1. When using GET for OCSP, make sure no double slash. > 2. Several throws clauses are not necessary. > > No

Re: RFR: 8274524: SSLSocket.close() hangs if it is called during the ssl handshake

2021-09-30 Thread Clive Verghese
On Wed, 29 Sep 2021 19:31:53 GMT, Alexey Bakhtin wrote: > Please review the patch for JDK-8274524 > > The fix just adds locks around InputStream read and skip operations to > prevent concurrent read from socket. > sun/security/ssl jtreg tests passed > api/javax_net/ssl/SSLSocket/setUseClientMod

Re: RFR: 8264849: Add KW and KWP support to PKCS11 provider

2021-09-30 Thread Valerie Peng
On Fri, 17 Sep 2021 23:22:21 GMT, Valerie Peng wrote: > Anyone has time to review this RFE for adding AES cipher with KW, KWP modes > support to SunPKCS11 provider? > > The main changes are in only one new class, i.e. P11KeyWrapCipher.java, which > is the CipherSpi impl for the native PKCS11 k

Re: RFR: 8264849: Add KW and KWP support to PKCS11 provider

2021-09-30 Thread Anthony Scarpino
On Fri, 17 Sep 2021 23:22:21 GMT, Valerie Peng wrote: > Anyone has time to review this RFE for adding AES cipher with KW, KWP modes > support to SunPKCS11 provider? > > The main changes are in only one new class, i.e. P11KeyWrapCipher.java, which > is the CipherSpi impl for the native PKCS11 k

Re: RFR: 8264849: Add KW and KWP support to PKCS11 provider

2021-09-30 Thread Anthony Scarpino
On Fri, 17 Sep 2021 23:22:21 GMT, Valerie Peng wrote: > Anyone has time to review this RFE for adding AES cipher with KW, KWP modes > support to SunPKCS11 provider? > > The main changes are in only one new class, i.e. P11KeyWrapCipher.java, which > is the CipherSpi impl for the native PKCS11 k

Integrated: 8274393: Suppress more warnings on non-serializable non-transient instance fields in security libs

2021-09-30 Thread Joe Darcy
On Mon, 27 Sep 2021 19:24:39 GMT, Joe Darcy wrote: > Follow-up change to JDK-8231262, augmentations to javac's Xlint:serial > checking are out for review (#5709) and various security libraries would need > some changes to pass under the expanded checks. > > The changes are to suppress warnings

Re: RFR: 8274393: Suppress more warnings on non-serializable non-transient instance fields in security libs [v3]

2021-09-30 Thread Joe Darcy
> Follow-up change to JDK-8231262, augmentations to javac's Xlint:serial > checking are out for review (#5709) and various security libraries would need > some changes to pass under the expanded checks. > > The changes are to suppress warnings where non-transient fields in > serializable types

Re: RFR: 8274393: Suppress more warnings on non-serializable non-transient instance fields in security libs [v2]

2021-09-30 Thread Weijun Wang
On Wed, 29 Sep 2021 18:13:14 GMT, Joe Darcy wrote: >> Follow-up change to JDK-8231262, augmentations to javac's Xlint:serial >> checking are out for review (#5709) and various security libraries would >> need some changes to pass under the expanded checks. >> >> The changes are to suppress war

RFR: 8274471: Verification of OCSP Response signed with RSASSA-PSS fails

2021-09-30 Thread Weijun Wang
Extra parameters need to be set for RSASSA-PSS signatures. We already have a helper method for that. Some other cleanups: 1. When using GET for OCSP, make sure no double slash. 2. Several throws clauses are not necessary. No regression test. OCSP needs to access an external server.

Integrated: 8274528: Add comment to explain an HKDF optimization in SSLSecretDerivation

2021-09-30 Thread Bradford Wetmore
On Thu, 30 Sep 2021 01:22:56 GMT, Bradford Wetmore wrote: > See comment, + a couple minor cleanups. This pull request has now been integrated. Changeset: c57ed22e Author:Bradford Wetmore URL: https://git.openjdk.java.net/jdk/commit/c57ed22e779e7efc8ff7f3c7ec08ce2cb1a738cb Stats:

Re: RFR: 8274528: Add comment to explain an HKDF optimization in SSLSecretDerivation

2021-09-30 Thread Jamil Nimeh
On Thu, 30 Sep 2021 01:22:56 GMT, Bradford Wetmore wrote: > See comment, + a couple minor cleanups. Looks good. - Marked as reviewed by jnimeh (Reviewer). PR: https://git.openjdk.java.net/jdk/pull/5765

Re: RFR: 8274528: Add comment to explain an HKDF optimization in SSLSecretDerivation

2021-09-30 Thread Jamil Nimeh
On Thu, 30 Sep 2021 14:15:59 GMT, Bradford Wetmore wrote: >> src/java.base/share/classes/sun/security/ssl/SSLSecretDerivation.java line >> 153: >> >>> 151: private final byte[] label; >>> 152: >>> 153: SecretSchedule(String label) { >> >> Why are we opening the visibility on t

Re: RFR: 8274528: Add comment to explain an HKDF optimization in SSLSecretDerivation

2021-09-30 Thread Bradford Wetmore
On Thu, 30 Sep 2021 04:45:15 GMT, Jamil Nimeh wrote: >> See comment, + a couple minor cleanups. > > src/java.base/share/classes/sun/security/ssl/SSLSecretDerivation.java line > 153: > >> 151: private final byte[] label; >> 152: >> 153: SecretSchedule(String label) { > > Why ar

Re: Verification of OCSP Responses signed with RSASSA-PSS fails with Java 11 LTS

2021-09-30 Thread can comert
I have recently received a Notification Email about the acceptance of the Bug report. It says the Bug is accepted and available under: http://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8274471 Hier is also the JIRA Issue for OpenJDK: https://bugs.openjdk.java.net/browse/JDK-8274471 Thanks f