The code change looks fine. My main concern is the number of tests that
have been converted to run in othervm which will make the tests run
slower. Did you explore how much effort it would be to convert some of
the test certificates to use stronger algorithms?
Also, I noticed many of the tests are using ocsp security properties.
These tests can now use the PKIXRevocationChecker API added in JDK 8
which won't put a dependency on security properties which require them
to be run with othervm.
--Sean
On 01/05/2014 10:08 PM, Xuelei Fan wrote:
Hi,
Please review this update for JDK 9.
webrev: http://cr.openjdk.java.net/~xuelei/8030829/webrev.00/
Per the spec of RFC 6151, MD5 must not be used for digital signatures
where collision resistance is required. Adding MD5 to
jdk.certpath.disabledAlgorithms security property can prevent the usage
of MD5 as digital signature algorithm during X.509 certificate operations.
It is not necessary to stop using HMAC-MD5 per RFC 6151. TLS is making
use of HMAC-MD5. It is not necessary to stop HMAC-MD5 in JSSE at present.
With this update, there are compatibility issues with those applications
still using MD5 signed certificate. Please upgrade the weak certificate
ASAP.
Thanks,
Xuelei
