RFR: 8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode

Daniel Jeliński djelinski at openjdk.org
Tue Feb 13 06:21:24 UTC 2024


Currently the SunPKCS11 provider requires other providers in order to offer ECDHE, FFDHE and RSA-PSS in TLS handshakes:
- FFDHE requires DiffieHellman AlgorithmParameters from SunJCE
- ECDHE requires the SunEC provider to be installed
- RSA-PSS requires RSASSA-PSS AlgorithmParameters from SunRsaSign

This PR removes these dependencies: 
- SunPKCS11 is modified to offer the PSS and DH AlgorithmParameters (using the same implementation classes as the original providers)
- Elliptic curve code is modified to remove the dependency on SunEC provider where possible

Two existing tests were modified to verify the changes:
- SigInteropPSS2 test was modified to install SunPKCS11 provider and remove SunRsaSign provider
- FipsModeTLS12 test was modified to verify the list of NamedGroups available on a SSLEngine.

Both modified tests fail without the changes, pass with them. Other tier1-3 tests continue to pass.

-------------

Commit messages:
 - Update remaining ECUtil usages
 - Update copyright and bugids
 - Reduce SunEC dependencies
 - Add DiffieHellman parameters
 - Add RSASSA-PSS AlgorithmParameters

Changes: https://git.openjdk.org/jdk/pull/17816/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=17816&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8325164
  Stats: 142 lines in 10 files changed: 35 ins; 66 del; 41 mod
  Patch: https://git.openjdk.org/jdk/pull/17816.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/17816/head:pull/17816

PR: https://git.openjdk.org/jdk/pull/17816



More information about the security-dev mailing list