On Thu, 10 Sep 2026 03:37:29 GMT, Hai-May Chao <[email protected]> wrote:
>> This is to add support in SunJSSE for the TLS 1.3 ML-DSA signature schemes: >> mldsa44, mldsa65, and mldsa87. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Hai-May Chao has updated the pull request incrementally with one additional > commit since the last revision: > > Updated with Artur's comment src/java.base/share/classes/sun/security/ssl/SignatureScheme.java line 553: > 551: keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) && > 552: ss.isAllowed(constraints, version, HANDSHAKE_SCOPE)) > { > 553: if (ss.hasNamedParam()) { I find correct solution somewhat fragile: - `AsymmetricKey.getParams()` that is being called in `KeyUtil.getAlgorithm()` is optional and defaults to `null` - that can be the case for 3rd party provider. - Hard-coding ML-DSA and EdDSA as the only algorithms that can have named parameters instead of testing the key directly. I suggest the following solution instead: Suggestion: if (signingKey.getParams() instanceof NamedParameterSpec nps && !ss.algorithm.equalsIgnoreCase(nps.getName())) { if (SSLLogger.isOn() && SSLLogger.isOn( SSLLogger.Opt.HANDSHAKE_VERBOSE)) { SSLLogger.finest( "Ignore the signature algorithm (" + ss + "), unsupported named parameter: " + nps.getName()); } continue; } src/java.base/share/classes/sun/security/ssl/SignatureScheme.java line 628: > 626: } > 627: > 628: private boolean hasNamedParam() { I suggest to remove this method. src/java.base/share/classes/sun/security/ssl/SignatureScheme.java line 677: > 675: } > 676: > 677: if (hasNamedParam()) { Suggestion: if (publicKey.getParams() instanceof NamedParameterSpec nps && !algorithm.equalsIgnoreCase(nps.getName())) { throw new InvalidKeyException("Unsupported named parameter: " + nps.getName()); } ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r3980588025 PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r3980595731 PR Review Comment: https://git.openjdk.org/jdk/pull/32529#discussion_r3980609919
