Code review request: 7180907: Jarsigner -verify fails if rsa file used sha-256 with authenticated attributes

[Xuelei Fan]

On 7/6/2012 1:03 PM, Weijun Wang wrote:
> Hi All
>
> I have two fixes for this bug:
>
> For 7u6: http://cr.openjdk.java.net/~weijun/7180907/7u/webrev.00/
>
Looks fine to me, except a very minor copyright date: you may want to 
use 2012 for SignerInfo.java.

> This simply makes the name recognizable. It's safe and I don't want
> anything broken in 7u6.
>
> For 8: http://cr.openjdk.java.net/~weijun/7180907/webrev.00/
>
Looks fine to me.

Xuelei

> This changes the internal name tables of AlgorithmId to match with the
> Standard Names doc [1]. I've searched thru all codes inside JDK that
> calls the AlgorithmId.getName() and made some trivial changes.
>
> Both using the same regression test.
>
> JPRT for jdk8 on the way.
>
> Thanks
> Max
>
> [1]
> http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html
>
>
> -------- Original Message --------
> === *Description*
> ============================================================
> SHORT SUMMARY:
> If a signature block (.RSA, a PKCS#7 object) contains authenticated
> attributes
> and uses a SHA-256 digest, verification will fail. The digest algorithm is
> stored in the PKCS7 using the correct OID (2.16.840.1.101.3.4.2.1) but
> sun.security.x509.AlgorithmId maps this back to an algorithm with name
> "SHA256". This is not a valid MessageDigest name - the correct version is
> SHA-256.
>
> The debug output from:
> jarsigner -J-Djava.security.debug=all -verbose -verify i3.jar
> debug.txt and i3.jar available here:
> ftp://bugftp.us.oracle.com/upload/bug_13/bug13941476
> INDICATORS:
> COUNTER INDICATORS:
> TRIGGERS:
> KNOWN WORKAROUND:
>
> PRESENT SINCE:
> N/A
> HOW TO VERIFY:
> Run attached test case
> NOTES FOR SE:
> None
> REGRESSION:
>