RFR: 8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode [v3]
Daniel Jeliński
djelinski at openjdk.org
Tue Mar 12 20:18:37 UTC 2024
> Currently the SunPKCS11 provider requires other providers in order to offer ECDHE, FFDHE and RSA-PSS in TLS handshakes:
> - FFDHE requires DiffieHellman AlgorithmParameters from SunJCE
> - ECDHE requires the SunEC provider to be installed
> - RSA-PSS requires RSASSA-PSS AlgorithmParameters from SunRsaSign
>
> This PR removes these dependencies:
> - SunPKCS11 is modified to offer the PSS and DH AlgorithmParameters (using the same implementation classes as the original providers)
> - Elliptic curve code is modified to remove the dependency on SunEC provider where possible
>
> Two existing tests were modified to verify the changes:
> - SigInteropPSS2 test was modified to install SunPKCS11 provider and remove SunRsaSign provider
> - FipsModeTLS12 test was modified to verify the list of NamedGroups available on a SSLEngine.
>
> Both modified tests fail without the changes, pass with them. Other tier1-3 tests continue to pass.
Daniel Jeliński has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains eight additional commits since the last revision:
- Use explicit provider in PSS engineGetParameters
- Merge remote-tracking branch 'origin' into pkcs11-parameters
- Restore original SunEC behavior
- Update remaining ECUtil usages
- Update copyright and bugids
- Reduce SunEC dependencies
- Add DiffieHellman parameters
- Add RSASSA-PSS AlgorithmParameters
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/17816/files
- new: https://git.openjdk.org/jdk/pull/17816/files/09ac283d..f39d4d5b
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=17816&range=02
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=17816&range=01-02
Stats: 124621 lines in 2707 files changed: 26343 ins; 86836 del; 11442 mod
Patch: https://git.openjdk.org/jdk/pull/17816.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/17816/head:pull/17816
PR: https://git.openjdk.org/jdk/pull/17816
More information about the security-dev
mailing list