[jdk25u-dev] RFR: 8359388: Stricter checking for cipher transformations

Roland Mesde duke at openjdk.org
Mon Jan 5 21:15:34 UTC 2026


Backporting JDK-8359388: Stricter checking for cipher transformations

This PR addresses a security and specification compliance issue in Java's cryptographic framework. The javax.crypto.Cipher class is supposed to accept transformation strings in two formats: either a simple algorithm name like "AES", or a complete specification like "AES/CBC/PKCS5Padding" that includes algorithm, mode, and padding.

However, a previous change (JDK-8358159) had made the parser too lenient, allowing malformed transformations with missing components like "AES//" or "AES/CBC/". This created ambiguity about what cryptographic operations would actually be performed, potentially leading to weaker security than developers intended.

This depends on https://github.com/openjdk/jdk25u-dev/pull/95

For parity with Oracle JDK.

Ran related tests on linux-x64, linux-aarch64, macos-aarch64 and windows-x64:

(Passed) - make test TEST=test/jdk/javax/crypto/Cipher/TestEmptyModePadding.java
(Passed) - make test TEST=test/jdk/javax/crypto

Results attached:

[windows-x64-specific-test.log](https://github.com/user-attachments/files/24439198/windows-x64-specific-test.log)
[windows-x64-specific-2-test.log](https://github.com/user-attachments/files/24439200/windows-x64-specific-2-test.log)
[macos-aarch64-specific-test.log](https://github.com/user-attachments/files/24439201/macos-aarch64-specific-test.log)
[macos-aarch64-specific-2-test.log](https://github.com/user-attachments/files/24439202/macos-aarch64-specific-2-test.log)
[linux-x64-specific-test.log](https://github.com/user-attachments/files/24439203/linux-x64-specific-test.log)
[linux-x64-specific-2-test.log](https://github.com/user-attachments/files/24439204/linux-x64-specific-2-test.log)
[linux-aarch64-specific-test.log](https://github.com/user-attachments/files/24439205/linux-aarch64-specific-test.log)
[linux-aarch64-specific-2-test.log](https://github.com/user-attachments/files/24439206/linux-aarch64-specific-2-test.log)

-------------

Depends on: https://git.openjdk.org/jdk25u-dev/pull/95

Commit messages:
 - Backport ec7c6be6a9e84c8cd2077fea07930592ddd13669

Changes: https://git.openjdk.org/jdk25u-dev/pull/130/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk25u-dev&pr=130&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8359388
  Stats: 100 lines in 2 files changed: 45 ins; 15 del; 40 mod
  Patch: https://git.openjdk.org/jdk25u-dev/pull/130.diff
  Fetch: git fetch https://git.openjdk.org/jdk25u-dev.git pull/130/head:pull/130

PR: https://git.openjdk.org/jdk25u-dev/pull/130


More information about the jdk-updates-dev mailing list