On Thu, 5 Sep 2024 23:17:32 GMT, Kevin Driver <kdri...@openjdk.org> wrote:
>> Introduce an API for Key Derivation Functions (KDFs), which are >> cryptographic algorithms for deriving additional keys from a secret key and >> other data. See [JEP 478](https://openjdk.org/jeps/478). >> >> Work was begun in [another PR](https://github.com/openjdk/jdk/pull/18924). > > Kevin Driver has updated the pull request with a new target base due to a > merge or a rebase. The incremental webrev excludes the unrelated changes > brought in by the merge/rebase. The pull request contains 31 additional > commits since the last revision: > > - Merge remote-tracking branch 'origin/master' into kdf-jep-wip > # Please enter a commit message to explain why this merge is necessary, > # especially if it merges an updated upstream into a topic branch. > # > # Lines starting with '#' will be ignored, and an empty message aborts > # the commit. > - several more review comments > - change impl class to use byte arrays rather than SecretKey objects where > possible > - updated delayed provider selection javadoc > - review comments > - use a delegate record to hold the spi and provider > - assorted review comment changes > - another round of review comments > - consistency with wording for addIKM and addSalt > - another round of code review comments > - ... and 21 more: https://git.openjdk.org/jdk/compare/dbf16956...a35e98c9 src/java.base/share/classes/com/sun/crypto/provider/HkdfKeyDerivation.java line 183: > 181: } > 182: length = anExpand.length(); > 183: if (length > (hmacLen * 255)) { Since hmacLen is an int, it makes sense to make the multiplication a long multiplication to avoid potential risk of overflow? Suggestion: if (length > (hmacLen * 255L)) { src/java.base/share/classes/com/sun/crypto/provider/HkdfKeyDerivation.java line 222: > 220: } > 221: length = anExtractThenExpand.length(); > 222: if (length > (hmacLen * 255)) { Same comment here w.r.t. overflow ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/20301#discussion_r1747127436 PR Review Comment: https://git.openjdk.org/jdk/pull/20301#discussion_r1747129304
