Hello all,
I've updated the fix to 8076999 with the following changes:
* We now use sun.security.x509.AlgorithmId and it internally uses
AlgorithmParameters implementations to handle the DER encoding and
decoding of encryption scheme parameters.
o This means that we need to add one new standard name and some
OID aliases for some AlgorithmParameters. See the CSR link
below for details.
* Added a new RC5Parameter AlgorithmParameters implementation to
SunJCE, plus unit tests.
CSR: https://bugs.openjdk.java.net/browse/JDK-8221936
Bug: https://bugs.openjdk.java.net/browse/JDK-8076999
Webrev: http://cr.openjdk.java.net/~jnimeh/reviews/8076999/webrev.02
On 5/24/2019 3:51 PM, Jamil Nimeh wrote:
Hello all, happy Friday!
Please review the following CSR and code review. This makes updates
to the SunJCE implementation of PBES2-based AlgorithmParameters. Many
of the details are in the CSR (see the link below). But a short list
of the updates:
* Add DER Encode/Decode support for the following OIDS from RFC 8018:
o PRFs: HmacSHA512/224, HmacSHA512/256
o Encryption Schemes: AES-192-CBC, DES, Triple-DES, RC2, RC5
* Enforce init-time type consistency between AlgorithmParameterSpec
objects and the algorithms they are used with (i.e. No using
RC5ParameterSpec with AES-128-CBC.
* Enforce sanity checks on AlgorithmParameterSpec objects used to
init (e.g. IV length checks, integer range checks, etc.)
* Fixed a bug where explicit DER decoding of the optional key length
field in PBKDF2-params would cause the PRF to be forced to
HmacSHA1 even if the DER indicated otherwise
* Allow incoming DER encoded AlgorithmIdentifier structures to honor
the OPTIONAL qualifier on the parameters field for both PRFs and
Encryption Schemes.
* If a null encryption scheme AlgorithmParameterSpec is provided
during init time, omit the PBES2-params.encryptionScheme's
parameter segment since it is OPTIONAL per the ASN.1 from RFC 5280
More details are in the CSR.
CSR: https://bugs.openjdk.java.net/browse/JDK-8221936
Bug: https://bugs.openjdk.java.net/browse/JDK-8076999
Webrev: http://cr.openjdk.java.net/~jnimeh/reviews/8076999/webrev.01/
--Jamil
