Re: RFR: JEP 249 (OCSP Stapling for TLS)

2015-06-23 Thread Jamil Nimeh
Hi Xuelei, thanks for the comments. Keep 'em coming! On 06/22/2015 08:26 PM, Xuelei Fan wrote: src/java.base/share/classes/sun/security/ssl/HandshakeStateManager.java === Thanks for the correction of typos, etc. line 777-797.

Re: RFR: JEP 249 (OCSP Stapling for TLS)

2015-06-23 Thread Xuelei Fan
On 6/23/2015 3:04 PM, Jamil Nimeh wrote: >> src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java >> == >> - private final boolean enableStatusRequestExtension = >> + private final static boolean enableStatusRequestExten

Re: disabledAlgorithms "DHE keySize < 1024" support?

2015-06-23 Thread Bernd Eckenfels
Hello, just for the records, IBM has issued in their June 2015 Security update a Logjam fix in 8 SR1-FP1 and 7R1 SP3-FP1 (and others). Unfortunatelly I havent found online documentation yet which describes what actually has changed. (their previous CVE analysis workaround did recommend to turn of

Re: RFR 8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently

2015-06-23 Thread Vincent Ryan
Your fix looks good. Thanks Max. > On 23 Jun 2015, at 07:34, Weijun Wang wrote: > > Hi Michael > > Webrev updated at > > http://cr.openjdk.java.net/~weijun/8023546/webrev.01 > > I added a check about the extra sign byte, I even added a null check in > KeyStore.java, although if the fix is d

Re: RFR: JEP 249 (OCSP Stapling for TLS)

2015-06-23 Thread Bernd Eckenfels
Hello, this is a general comment, not necesarily applicable for the OCSP stapling options directly: Am Tue, 23 Jun 2015 15:39:30 +0800 schrieb Xuelei Fan : > Caches, for example session/trust manager/key manager, are used a lot > in SSL/TLS handshaking. Dynamic system property may make the > b

Re: RFR: JEP 249 (OCSP Stapling for TLS)

2015-06-23 Thread Xuelei Fan
On 6/23/2015 4:17 PM, Bernd Eckenfels wrote: > Hello, > > this is a general comment, not necesarily applicable for the OCSP > stapling options directly: > > Am Tue, 23 Jun 2015 15:39:30 +0800 > schrieb Xuelei Fan : > >> Caches, for example session/trust manager/key manager, are used a lot >> in

Re: RFR: JEP 249 (OCSP Stapling for TLS)

2015-06-23 Thread Jamil Nimeh
On 06/23/2015 01:17 AM, Bernd Eckenfels wrote: Hello, this is a general comment, not necesarily applicable for the OCSP stapling options directly: Am Tue, 23 Jun 2015 15:39:30 +0800 schrieb Xuelei Fan: Caches, for example session/trust manager/key manager, are used a lot in SSL/TLS handsh