On Thu, 6 Aug 2026 21:35:48 GMT, Valerie Peng <[email protected]> wrote:

>> Initial commit containing the public API changes and related regression 
>> tests.
>> 
>> ---------
>> - [x] I confirm that I make this contribution in accordance with the 
>> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai).
>
> Valerie Peng has updated the pull request incrementally with one additional 
> commit since the last revision:
> 
>   import cleanup.

src/java.base/share/classes/com/sun/crypto/provider/Argon2Impl.java line 205:

> 203:         void fillMemoryBlocks() {
> 204:             int poolSize = Math.min(lanes,
> 205:                     Runtime.getRuntime().availableProcessors());

Should it allow to specify a Max or maybe never max out on all CPU Cores? For 
concurrent services or for example CPU Limited Kubernetes pods this is deadly, 
Not to mention the possible dos a brute force attacker could Provoke. In an App 
I would use a Single Pool Limited to a Fraktion of the CPUs. (Maybe its not so 
bad if the lane Parameter is used responsible?)
Also cam the threads get a name please

src/java.base/share/classes/sun/security/util/Argon2Util.java line 97:

> 95:                 }
> 96:                 // mapping keyid to secret value is application-specific;
> 97:                 throw new IllegalArgumentException("keyid is not 
> supported");

Can This be somehow still used by Applications who know how to provide the key?

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/29597#discussion_r3781094263
PR Review Comment: https://git.openjdk.org/jdk/pull/29597#discussion_r3781056708

Reply via email to