On Wed, 16 Sep 2026 16:16:23 GMT, Severin Gehwolf <[email protected]> wrote:
>> Andreas Chmielewski has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Fixed derivation of SSLMasterKey > > src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Tls12ExtendedMasterSecretGenerator.java > line 84: > >> 82: throw new InvalidAlgorithmParameterException( >> 83: "Extended Master Secret is only supported for TLS >> 1.2"); >> 84: } > > Isn't this a tautology now? We should never enter this code for any other TLS > version other than TLS 1.2 My reasoning for keeping the check was that it mirrors the validation performed by TlsMasterSecretGenerator and keeps the SPI implementation self-contained, i.e. it validates that the supplied parameters are consistent with the algorithm it implements rather than relying entirely on the caller. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32081#discussion_r4036574213
