On Fri, 25 Apr 2025 15:41:09 GMT, Weijun Wang <wei...@openjdk.org> wrote:
>> Valerie Peng has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> Undo the special workaround for JSSE in PKCS11 HKDF impl.
>
> src/java.base/share/classes/sun/security/ssl/PreSharedKeyExtension.java line
> 851:
>
>> 849: return hkdf.deriveKey("TlsBinderKey",
>> 850: HKDFParameterSpec.expandOnly(earlySecret, hkdfInfo,
>> 851: hashAlg.hashLength));
>
> Is it possible to combine the 2 `deriveKey` calls above into a single
> Extract-Then-Expand call? Then you don't need to clean up `earlySecret`.
Should be possible, let me give it a try. Thanks~
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/24393#discussion_r2060758979
