RFR: 8353113: Peer supported certificate signature algorithms are not being checked with default SunX509 key manager [v6]
Artur Barashev
abarashev at openjdk.org
Wed Jun 18 15:54:48 UTC 2025
> When the deafult SunX509KeyManagerImpl is being used we are in violation of TLSv1.3 RFC spec because we ignore peer supported certificate signatures sent to us in "signature_algorithms"/"signature_algorithms_cert" extensions:
> https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2.2
> https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2.3
>
> X509KeyManagerImpl on the other hand includes the algorithms sent by the peer in "signature_algorithms_cert" extension (or in "signature_algorithms" extension when "signature_algorithms_cert" extension isn't present) in the algorithm constraints being checked.
>
> **SUNX509 KeyManager performance before the change**
> Benchmark (resume) (tlsVersion) Mode Cnt Score Error Units
> SSLHandshake.doHandshake true TLSv1.2 thrpt 15 19758.012 ± 758.237 ops/s
> SSLHandshake.doHandshake true TLS thrpt 15 1861.695 ± 14.681 ops/s
> SSLHandshake.doHandshake false TLSv1.2 thrpt 15 **1186.962** ± 12.085 ops/s
> SSLHandshake.doHandshake false TLS thrpt 15 **1056.288** ± 7.197 ops/s
>
> **SUNX509 KeyManager performance after the change**
> Benchmark (resume) (tlsVersion) Mode Cnt Score Error Units
> SSLHandshake.doHandshake true TLSv1.2 thrpt 15 20954.399 ± 260.817 ops/s
> SSLHandshake.doHandshake true TLS thrpt 15 1813.401 ± 13.917 ops/s
> SSLHandshake.doHandshake false TLSv1.2 thrpt 15 **1158.190** ± 6.023 ops/s
> SSLHandshake.doHandshake false TLS thrpt 15 **1012.988** ± 10.943 ops/s
Artur Barashev has updated the pull request incrementally with one additional commit since the last revision:
Add more unit tests. Some code refactoring and adjustments.
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/25016/files
- new: https://git.openjdk.org/jdk/pull/25016/files/448442e9..eaf343ad
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=25016&range=05
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=25016&range=04-05
Stats: 171 lines in 5 files changed: 106 ins; 36 del; 29 mod
Patch: https://git.openjdk.org/jdk/pull/25016.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/25016/head:pull/25016
PR: https://git.openjdk.org/jdk/pull/25016
More information about the net-dev
mailing list