[security-dev 01495]: ECC non-named parameters in ECParameters.java

[Tomas Gustavsson]

Hi,

In ECParameters,java there is a section that is commented out and claims
to be incomplete. We have used this code successfully to use Brainpool
curves (not supported by jdk otherwise) using an HSM (SafeNet
ProtectServer). I wrote a howto for users of EJBCA at
http://ejbca.org/cvccas.html#Using%20EC%20keys.
This howto naturally includes patching ECParameters to enable this code.

It seems to work just fine. Does anyone know why this code is supposed
to be incomplete? And what would it take to get it enabled in JDK so we
don't have to patch the jdk?

Kind regards,
Tomas Gustavsson
PrimeKey Solutions AB