On Tue, 14 Jul 2026 17:08:19 GMT, Sean Mullan <[email protected]> wrote:
>> Valerie Peng has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> updated to address review comments.
>
> src/java.base/share/classes/com/sun/crypto/provider/Argon2DerivedKey.java
> line 177:
>
>> 175: */
>> 176: @java.io.Serial
>> 177: private Object writeReplace() throws java.io.ObjectStreamException {
>
> I question if we need to implement Serializable. Is there a need or use case
> for this? This will just create a dependency that would be difficult to
> remove later. Otherwise I think we should just throw an exception that
> serialization is not supported.
This derived key could potentially be used for many purposes, so I followed the
pattern for general secret key objects. Maybe we can disallow serialization for
now and add the support later if there are requests/strong use cases. Let me
explore a bit before making this shift.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/29597#discussion_r3715084244
