Integrated: 8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode

[Daniel Jeliński]

On Mon, 12 Feb 2024 20:23:27 GMT, Daniel Jeliński <djelinski at openjdk.org> wrote:

> Currently the SunPKCS11 provider requires other providers in order to offer ECDHE, FFDHE and RSA-PSS in TLS handshakes:
> - FFDHE requires DiffieHellman AlgorithmParameters from SunJCE
> - ECDHE requires the SunEC provider to be installed
> - RSA-PSS requires RSASSA-PSS AlgorithmParameters from SunRsaSign
> 
> This PR removes these dependencies: 
> - SunPKCS11 is modified to offer the PSS and DH AlgorithmParameters (using the same implementation classes as the original providers)
> - Elliptic curve code is modified to remove the dependency on SunEC provider where possible
> 
> Two existing tests were modified to verify the changes:
> - SigInteropPSS2 test was modified to install SunPKCS11 provider and remove SunRsaSign provider
> - FipsModeTLS12 test was modified to verify the list of NamedGroups available on a SSLEngine.
> 
> Both modified tests fail without the changes, pass with them. Other tier1-3 tests continue to pass.

This pull request has now been integrated.

Changeset: 8f9899b2
Author:    Daniel Jeliński <djelinski at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/8f9899b23ee46ad986bc719d3e2eec722d8d6bf8
Stats:     96 lines in 10 files changed: 29 ins; 30 del; 37 mod

8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode

Reviewed-by: valeriep

-------------

PR: https://git.openjdk.org/jdk/pull/17816