On Thu, 7 Mar 2024 15:12:18 GMT, Sean Mullan <mul...@openjdk.org> wrote:
>> This enhancement simplifies and improves the performance of the Comparator >> that the PKIX CertPathBuilder uses to sort candidate certificates. >> >> [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1) requires >> that certificates include authority and subject key identifiers to >> facilitate cert path discovery. When the certificates comply with RFC 5280, >> the sorting algorithm is fast and efficient. However, there may be cases >> where certificates do not include the proper KIDs, for legacy or other >> reasons. This enhancement targets those cases and has shown an increase in >> performance of `CertPathBuilder.build` by up to 2x in tests involving >> certificates that do not contain KIDs. Specific changes include: >> >> - Removed and simplified some of the steps in `PKIXCertComparator.compare` >> method. Some of these steps were not a good representation of common >> certificate hierarchies and were overly expensive to perform. >> - Several methods in `X500Name` and `Builder` have been made obsolete and >> thus removed. >> - `X500Name` has been changed to use shared secrets instead of reflection to >> access non-public members of `X500Principal`, and vice-versa. >> - The `CertificateBuilder` test code has been enhanced to set reasonable >> defaults for serial number and validity fields of a certificate > > Sean Mullan has updated the pull request with a new target base due to a > merge or a rebase. The incremental webrev excludes the unrelated changes > brought in by the merge/rebase. The pull request contains 15 additional > commits since the last revision: > > - Weijun's comments. > - Merge > - Fix whitespace error. Improve debugging. Change return value of > distanceToCommonAncestor(). > - Add more comments. Remove unnecessary import. > - Fix whitespace. > - Update copyrights. > - Merge > - Simplify and improve performance of PKIXCertComparator. > - Regression test. > - Use shared secrets instead of reflection. > - ... and 5 more: https://git.openjdk.org/jdk/compare/cf6239b6...20b714dd Marked as reviewed by weijun (Reviewer). ------------- PR Review: https://git.openjdk.org/jdk/pull/17248#pullrequestreview-1829985213
