Re: Java 11 - SSL handshake for ECDH cipher suites trigger Invalid ECDH ServerKeyExchange with non-default security provider

2018-09-20 Thread Jaikiran Pai
Just checking - does this look like a genuine issue? Anything else I can provide to help reproduce this? -Jaikiran On 18/09/18 7:06 PM, Jaikiran Pai wrote: > I have been testing some projects that I know of, with Java 11 RC. > There's one specific test that has been failing for me, for a while n

Re: Java 11 - SSL handshake for ECDH cipher suites trigger Invalid ECDH ServerKeyExchange with non-default security provider

2018-09-20 Thread Xuelei Fan
Hi Jaikiran, Does it happen if using JDK crypto provider? Thanks, Xuelei On 9/20/2018 6:16 AM, Jaikiran Pai wrote: Just checking - does this look like a genuine issue? Anything else I can provide to help reproduce this? -Jaikiran On 18/09/18 7:06 PM, Jaikiran Pai wrote: I have been testing

Re: Java 11 - SSL handshake for ECDH cipher suites trigger Invalid ECDH ServerKeyExchange with non-default security provider

2018-09-20 Thread Jaikiran Pai
Hello Xuelei, It doesn't happen if both the server side and client side use the JDK crypto provider. However if any one side uses a different crypto provider (bouncycastle in this case) then it throws this exception. -Jaikiran On 20/09/18 8:37 PM, Xuelei Fan wrote: > Hi Jaikiran, > > Does it ha

Re: Java 11 - SSL handshake for ECDH cipher suites trigger Invalid ECDH ServerKeyExchange with non-default security provider

2018-09-20 Thread Xuelei Fan
Thanks for the quick reply, Jaikiran! Per your diff code, it sounds like a crypto provider implementation bugs. JDK is using a lazy initialization so that the right provider get used. Third party's provider may not do this way. Would you please help to verify if the parameters get used in

Re: Java 11 - SSL handshake for ECDH cipher suites trigger Invalid ECDH ServerKeyExchange with non-default security provider

2018-09-20 Thread Jaikiran Pai
Sure, I'll run some tests tomorrow and get more details on whether/how bouncycastle uses these parameters if they are set after the init verify/sign calls. -Jaikiran On 20/09/18 9:05 PM, Xuelei Fan wrote: > Thanks for the quick reply, Jaikiran! > > Per your diff code, it sounds like a crypto pro

Re: TLSv.1.3 interropt problems with OpenSSL 1.1.1 when used on the client side with mutual auth

2018-09-20 Thread Bradford Wetmore
Just to followup on your (Norman's) earlier question: On 9/19/2018, Norman wrote: >> Is this just the >> initial version set or do you not plan to fix it in Java11 ? and On 9/19/2018 9:34 AM, Xuelei Fan wrote: > It is just a initial version set. Getting this fix into JDK 12 was easy as 12 is i

Re: TLSv.1.3 interropt problems with OpenSSL 1.1.1 when used on the client side with mutual auth

2018-09-20 Thread Norman Maurer
Got it... just keep in mind that this bug make it kind of unusable on the client-side so I think it should be a high priority to fix it rather sooner then later. Especially as the fix is really a one line change Norman > Am 20.09.2018 um 11:30 schrieb Bradford Wetmore : > > Just to followup on

Code Review Request, JDK-8210974 : No extensions debug log for ClientHello

2018-09-20 Thread Xuelei Fan
Hi, Please review this simple fix for SunJSSE debug log: http://cr.openjdk.java.net/~xuelei/8210974/webrev.00/ The debug log for ClientHello message does not appear in JDK 12. Trivial update, no new regression test. Thanks, Xuelei

Re: Code Review Request, JDK-8210974 : No extensions debug log for ClientHello

2018-09-20 Thread Jamil Nimeh
Looks good. On 9/20/2018 1:02 PM, Xuelei Fan wrote: Hi, Please review this simple fix for SunJSSE debug log:   http://cr.openjdk.java.net/~xuelei/8210974/webrev.00/ The debug log for ClientHello message does not appear in JDK 12. Trivial update, no new regression test. Thanks, Xuelei

Re: Code Review Request, JDK-8210974 : No extensions debug log for ClientHello

2018-09-20 Thread Bradford Wetmore
Ditto. Brad On 9/20/2018 1:03 PM, Jamil Nimeh wrote: Looks good. On 9/20/2018 1:02 PM, Xuelei Fan wrote: Hi, Please review this simple fix for SunJSSE debug log:   http://cr.openjdk.java.net/~xuelei/8210974/webrev.00/ The debug log for ClientHello message does not appear in JDK 12. Trivia

RFR: backport of JDK-8209916, JDK-8210334, JDK-8210846 to jdk11u

2018-09-20 Thread Jamil Nimeh
Hello all, This review is for a backport of 3 TLS interoperability issues that have come up over the past week or so.  These are already in jdk/jdk.  They cover the following issues: * An NPE thrown during processing of the supported groups extension with curves not enabled by default *