RFR: 8348732: SunJCE and SunPKCS11 have different PBE key encodings [v5]

[Mark Powers]

On Tue, 15 Apr 2025 23:01:56 GMT, Valerie Peng <valeriep at openjdk.org> wrote:

>> As part of [https://bugs.openjdk.org/browse/JDK-8301553](JDK-8301553), SunPKCS11 provider added support for PBE SecretKeyFactories for `HmacPBESHAxxx` and `PBEWithHmacSHAxxxAndAES_yyy`. These impls produce keys whose encoding contains the PBKDF2 derived bytes. Given that SunJCE provider have supported `PBEWithHmacSHAxxxAndAES_yyy` SecretKeyFactories whose key encoding is the password bytes for long time. Such difference may be very confusing, e.g. using the same KeySpec and same-name SecretKeyFactory (from different providers), the resulting keys have same algorithm and format but different encodings.
>> 
>> Given that the `P11Mac` and `P11PBECipher` classes already do key derivation internally, these PKCS11 SecretKeyFactories aren't a must-have and are proposed to be removed. I've also aligned the com.sun.crypto.provider.PBEKey class with com.sun.crypto.provider.PPBKDF2KeyImpl class to switch to "UTF-8" when converting the char[] to byte[]. This is to accomodate unicode passwords and given that "UTF-8" encoding is same for ASCII characters, this change should not affect backward compatibility.
>
> Valerie Peng has updated the pull request incrementally with one additional commit since the last revision:
> 
>   minor comment and copyright year update.

src/java.base/share/classes/sun/security/util/PBEUtil.java line 270:

> 268:                 throw new InvalidKeyException("Missing password");
> 269:             }
> 270:             passwdChars = decodePassword(passwdBytes);

Not this line, but on line 286 a little ways down, you could use pattern matching and delete line 290.

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11PBECipher.java line 27:

> 25: package sun.security.pkcs11;
> 26: 
> 27: import java.security.AlgorithmParameters;

Down on line 41, you don't need to import PBEParameterSpec.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/24068#discussion_r2049416362
PR Review Comment: https://git.openjdk.org/jdk/pull/24068#discussion_r2049538889