AW: RFR [11] CSR for "Add Brainpool ECC support (RFC 5639)"

[Tobias Wagner]

Hi Valerie and Bernd, 
Valerie is right, I tested my JTREG Tests against SoftHSM2 in March:
http://mail.openjdk.java.net/pipermail/security-dev/2018-March/016863.html
I don't think there are more PKCS#11 related issues, as SunEC is not a PKCS#11 implementation. There are only shared tests.

The JTREG known answer tests use the X9.62 key format as they are used in certificates as well. I assume, brainpool public keys would work in certificates as well. 

I actually implemented the support for brainpool curves in TLS as well, but I had no time to provide proper JTREG tests for that, and therefore no patch yet.

Regards, Tobias

-- 
phone:   +49 221 222896 17
fax:     +49 221 222896 11
keybase: https://keybase.io/toebix

n - d e s i g n   G m b H 
https://n-design.de
Alpenerstr. 16
50825 Köln
Deutschland / Germany

Amtsgericht Köln HRB 33766 B
Geschäftsführer Andy Kohl

> -----Ursprüngliche Nachricht-----
> Von: security-dev <security-dev-bounces at openjdk.java.net> Im Auftrag von
> Valerie Peng
> Gesendet: Donnerstag, 21. Juni 2018 01:07
> An: security-dev at openjdk.java.net
> Betreff: Re: RFR [11] CSR for "Add Brainpool ECC support (RFC 5639)"
> 
> Are you asking about CSR or existing bug for including Brainpool support
> in TLS?
> 
> I saw some bugs which mentions errors/exceptions which brainpool is
> used, e.g. JSSE has https://bugs.openjdk.java.net/browse/JDK-7189107,
> key tool has https://bugs.openjdk.java.net/browse/JDK-8201290. After
> this brainpool support is integrated, it'll be easier to re-evaluate
> these.
> 
> 
> As for PKCS11, Tobias tested this against a 3rd party PKCS11 library and
> the result is positive if I recall correctly.
> 
> 
> Thanks,
> Valerie
> 
> 
> On 6/18/2018 1:26 PM, Bernd Eckenfels wrote:
> 
> 
> 	Hello,
> 
> 
> 
> 	not a Reviewer, but some Questions on the CSR:
> 
> 
> 
> 	*	Are there other CSRs for including in TLS?
> 	*	I also wonder if PKI (CA Signatures) will work out of the box
> then (OID aliases?)
> 	*	Does PKCS11 require additional changes? (especially for the
> Government use mentioned in the justification HSMs are often mandatory)
> 
> 
> 
> 	Gruss
> 
> 	Bernd
> 
> 	--
> 	http://bernd.eckenfels.net
> 
> 
>