RFR: 8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode [v3]

[Daniel Jeliński]

On Tue, 12 Mar 2024 20:18:37 GMT, Daniel Jeliński <djelinski at openjdk.org> wrote:

>> Currently the SunPKCS11 provider requires other providers in order to offer ECDHE, FFDHE and RSA-PSS in TLS handshakes:
>> - FFDHE requires DiffieHellman AlgorithmParameters from SunJCE
>> - ECDHE requires the SunEC provider to be installed
>> - RSA-PSS requires RSASSA-PSS AlgorithmParameters from SunRsaSign
>> 
>> This PR removes these dependencies: 
>> - SunPKCS11 is modified to offer the PSS and DH AlgorithmParameters (using the same implementation classes as the original providers)
>> - Elliptic curve code is modified to remove the dependency on SunEC provider where possible
>> 
>> Two existing tests were modified to verify the changes:
>> - SigInteropPSS2 test was modified to install SunPKCS11 provider and remove SunRsaSign provider
>> - FipsModeTLS12 test was modified to verify the list of NamedGroups available on a SSLEngine.
>> 
>> Both modified tests fail without the changes, pass with them. Other tier1-3 tests continue to pass.
>
> Daniel Jeliński has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains eight additional commits since the last revision:
> 
>  - Use explicit provider in PSS engineGetParameters
>  - Merge remote-tracking branch 'origin' into pkcs11-parameters
>  - Restore original SunEC behavior
>  - Update remaining ECUtil usages
>  - Update copyright and bugids
>  - Reduce SunEC dependencies
>  - Add DiffieHellman parameters
>  - Add RSASSA-PSS AlgorithmParameters

Thanks for the review!

-------------

PR Comment: https://git.openjdk.org/jdk/pull/17816#issuecomment-1995434396