RFR: 8267319: Use larger default key sizes and algorithms based on CNSA [v8]
Valerie Peng
valeriep at openjdk.java.net
Wed Mar 23 22:48:41 UTC 2022
> It's been several years since we increased the default key sizes. Before shifting to PQC, NSA replaced its Suite B cryptography recommendations with the Commercial National Security Algorithm Suite which suggests:
>
> - SHA-384 for secure hashing
> - AES-256 for symmetric encryption
> - RSA with 3072 bit keys for digital signatures and for key exchange
> - Diffie Hellman (DH) with 3072 bit keys for key exchange
> - Elliptic curve [P-384] for key exchange (ECDH) and for digital signatures (ECDSA)
>
> So, this proposed changes made the suggested key size and algorithm changes. The changes are mostly in keytool, jarsigner and their regression tests, so @wangweij Could you please take a look?
>
> Thanks!
Valerie Peng has updated the pull request incrementally with one additional commit since the last revision:
Added comment regarding possible deadlocks.
-------------
Changes:
- all: https://git.openjdk.java.net/jdk/pull/7652/files
- new: https://git.openjdk.java.net/jdk/pull/7652/files/1eb63292..a48ccef5
Webrevs:
- full: https://webrevs.openjdk.java.net/?repo=jdk&pr=7652&range=07
- incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=7652&range=06-07
Stats: 4 lines in 1 file changed: 4 ins; 0 del; 0 mod
Patch: https://git.openjdk.java.net/jdk/pull/7652.diff
Fetch: git fetch https://git.openjdk.java.net/jdk pull/7652/head:pull/7652
PR: https://git.openjdk.java.net/jdk/pull/7652
More information about the security-dev
mailing list