Code Review Request 8072452 Support DHE sizes up to 8192-bits

[Bernd Eckenfels]

Hello Xuelei,

glad to see this. :)

 
--java.base/share/classes/sun/security/ssl/DHCrypt.java

Does the comment "// FEDHE" stand for FFDHE (JDK-8140436)?
maybe name the variables ffdheXXXX instead of pXXXX? (they might be
directly used clients to verify well known parameters)


Unrelated to the change: What about reomving p512 and p768 from the
cache. In normal scenarios they are disabled, but if somebody enables
the weak sizes he would benefit from dynamic generation (and not much
time is needed).


Line 154: just an observation, the other places in this file request
'JsseJce.get*("DiffieHellmann"' but the KeyFactory is requested by name
"DH".


--java.base/share/classes/com/sun/crypto/provider/DHKeyPairGenerator.java

For my taste it would be good to document why generation of
modulus primes >1024 bit is not supported. Is this a performance issue
or a problem with the security of the generator?)


--java.base/share/classes/com/sun/crypto/provider/DHParameterGenerator.java

Line 64+70: Does not support 8k?


--java.base/share/classes/sun/security/provider/ParameterCache.java

Observation unrelated to the patch: Would it make sense in DHCrypt to
reference the parametes from ParamterCache and not have 2 distinguished
places where same (if any) constants are defined? (the differente
caches can still exist)

Line  68+94+168 - the 3072bit case is provided, should also be supporte?

Line 291+333 - in case you need to have another revision there is a
nit: blank lines are used in all other places before the xxxCache.put

Another observation not related to your change: 
DHParameterGenerator:141+157+DSAParameterGenerator:152 is it
intentional that two use provider SUN, SunJCE and one does not specify
a provider?

Greetings
Bernd


Am Fri, 1 Apr 2016 08:53:05 -0700
schrieb Xuelei Fan <Xuelei.Fan at Oracle.COM>:

> Hi,
> 
> Please review this improvement update to support DHE sizes up to 
> 8192-bits and DSA sizes up to 3072-bits:
> 
>     http://cr.openjdk.java.net/~xuelei/8072452/webrev.00
> 
> This updated extends to support 3072-bits DH and DSA parameters 
> generation, and pre-computed DH parameters up to 8192 bits and 
> pre-computed DSA parameters up to 3072-bits.
> 
> Thanks,
> Xuelei