On Tue, 8 Oct 2024 01:13:17 GMT, Valerie Peng <valer...@openjdk.org> wrote:
>> Weijun Wang has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> null check as asserts, and better exception messages
>
> src/java.base/share/classes/sun/security/pkcs/NamedPKCS8Key.java line 81:
>
>> 79: } finally {
>> 80: val.clear();
>> 81: }
>
> The `this.key` is from the `PKCS8Key` class, right? However, looking at the
> impl of the `PKCS8Key` class, it looks to me that `key` should be equivalent
> to the `rawBytes` here instead of a DER bytes with OctetString tag.
Yes, `this.key` is the one inside `PKCS8Key`.
Since EdDSA and XDH, the private key has taken this OCTET in OCTET approach. My
code is identical to the EdDSA code at
https://github.com/openjdk/jdk/blob/adca97b659d725b0dd320322297dcbd1b443a047/src/java.base/share/classes/sun/security/ec/ed/EdDSAPrivateKeyImpl.java#L50-L64.
In https://datatracker.ietf.org/doc/html/rfc8410#autoid-7 and
https://www.ietf.org/archive/id/draft-ietf-lamps-kyber-certificates-04.html#name-private-key-format,
you can see the definitions:
OneAsymmetricKey ::= SEQUENCE {
version Version,
privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
privateKey PrivateKey,
...
}
PrivateKey ::= OCTET STRING
... CurvePrivateKey object and wrapped by the OCTET STRING of the
"privateKey" field.
CurvePrivateKey ::= OCTET STRING
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/21167#discussion_r1791094194
