RFR: 8349583: Add mechanism to disable signature schemes based on their TLS scope [v13]

Artur Barashev abarashev at openjdk.org
Thu Mar 6 20:36:24 UTC 2025


> Currently when a signature scheme constraint is specified with "jdk.tls.disabledAlgorithms" property we don't differentiate between signatures used to sign a TLS handshake exchange and the signatures used in TLS certificates:
> https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.3
> 
> Also fixing JDK-8350807 on the server side just as a side-effect, not a dedicated fix for that issue.

Artur Barashev has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains 15 additional commits since the last revision:

 - Merge branch 'master' into JDK-8349583
 - Remove the fix for JDK-8350807. Update documentation.
 - Update documentation and unit tests to signal TLS scope case-insensitivity
 - Update 2 more copyrights
 - Update TLS version in one more unit test
 - - Check signature schemes that are enabled specifically for the handshake when HANDSHAKE_SCOPE is specified
   - Update copyright
   - Update HTTPS tests that are broken because we also fix JDK-8350807 on the server side as a side-effect
 - Revert "Restore original arguments for getSupportedAlgorithms() calls"
   
   This reverts commit 4b335619ee6a79a6f609fe98c5339588a6a1342a.
 - Restore original arguments for getSupportedAlgorithms() calls
 - - Refactor code to use existing "usage" constraint.
   - Rename SSLCryptoScope to SSLScope, make it public.
 - Merge branch 'master' into JDK-8349583
 - ... and 5 more: https://git.openjdk.org/jdk/compare/8e95f066...7a786e0d

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/23681/files
  - new: https://git.openjdk.org/jdk/pull/23681/files/efb11851..7a786e0d

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=23681&range=12
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=23681&range=11-12

  Stats: 7401 lines in 193 files changed: 3664 ins; 3082 del; 655 mod
  Patch: https://git.openjdk.org/jdk/pull/23681.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/23681/head:pull/23681

PR: https://git.openjdk.org/jdk/pull/23681


More information about the security-dev mailing list