> The enhancement implements the new RFC 9846-style support group selection on > the server side (first mutual group matters) and change the supported-groups > format. Specifically: > > 1. `SSLParameters.setNamedGroups` and the `jdk.tls.namedGroups` system > property now recognize a *-prefix on a group name. > 2. The prefix does not change the supported_groups extension. > 3. On a TLS 1.3 client, usable starred groups determine the initial key_share > entries. If no usable starred group remains, JSSE falls back to its existing > automatic key-share selection. > 4. SunJSSE’s default parameters contains 2 starred groups, which can be > observed by `getNamedGroups`. > 5. The server ignores the marker in its own configuration. > 6. Server group selection now follows RFC 9846: choose the first mutually > supported group according to the client’s supported_groups order, then sends > ServerHello if its key share is present or HelloRetryRequest if not. > > No new API or system property defined for the new format. The existing > methods and system property are already called a lot by both JSSE itself and > an application. The default value of the system property is empty which gives > each provider the chance to define it itself. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Weijun Wang has updated the pull request incrementally with one additional commit since the last revision: no star in default groups ------------- Changes: - all: https://git.openjdk.org/jdk/pull/32586/files - new: https://git.openjdk.org/jdk/pull/32586/files/bb5461ae..14f4bb49 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=32586&range=02 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=32586&range=01-02 Stats: 4 lines in 2 files changed: 0 ins; 0 del; 4 mod Patch: https://git.openjdk.org/jdk/pull/32586.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/32586/head:pull/32586 PR: https://git.openjdk.org/jdk/pull/32586
