RFR: 8242068: Signed JAR support for RSASSA-PSS and EdDSA [v8]
Valerie Peng
valeriep at openjdk.java.net
Fri Oct 16 20:04:16 UTC 2020
On Fri, 16 Oct 2020 15:51:25 GMT, Weijun Wang <weijun at openjdk.org> wrote:
>> Major points in CSR at https://bugs.openjdk.java.net/browse/JDK-8245274:
>>
>> - new sigalg "RSASSA-PSS", "EdDSA", "Ed25519" and "Ed448" can be used in jarsigner
>>
>> - The ".RSA" and ".EC" block extension types (PKCS #7 SignedData inside a signed JAR) are reused for new signature
>> algorithms
>>
>> - A new JarSigner property "directsign"
>>
>> - Updating the jarsigner tool doc
>>
>> Major code changes:
>>
>> - Always use the signature algorithm directly as SignerInfo::signatureAlgorithm. We used to use the encryption algorithm
>> there like RSA, DSA, and EC. Now it's always SHA1withRSA or RSASSA-PSS.
>>
>> - Move signature related utilities methods from AlgorithmId.java to SignatureUtil.java
>>
>> - Add new SignatureUtil methods fromKey() and fromSignature() to simplify creating Signature and getting its AlgorithmId
>>
>> - Use the new methods in PKCS10, X509CertImpl, and X509CRLImpl signing
>>
>> - Add a new (and intuitive, IMHO) PKCS7::generateNewSignedData capable of all old and new signature algorithms
>>
>> - Mark all -altsign related code deprecated and they can be removed once ContentSigner is removed
>
> Weijun Wang has updated the pull request incrementally with one additional commit since the last revision:
>
> no default getParamSpec, renames, comments, more testing
Marked as reviewed by valeriep (Reviewer).
-------------
PR: https://git.openjdk.java.net/jdk/pull/322
More information about the security-dev
mailing list