<html>
<body>
This appears to be related specifically to PKCS11.
Specifically, PKCS11 v2.20 has some ambiguity of the representation of an
EC point (which is different in the text than an ASN1 ECPoint).<br><br>
This is being clarified in v2.30 with the unencoded point format (e.g.the
format described in X9.62, where the first octet indicates the
encoding and there are either N or 2N octets following) being the
expected value, but with PKCS11 providers allowed - legacy - to accept
either.<br><br>
One of the reasons for going that way was how the JDK PKCS11 provider had
interpreted the issue and implemented its code.<br><br>
I don't support this fix - among other things, this fix only deals with
1/2 of the problem. The other half is related to encoding the
value. Also, changing the code at decodePoint seems further
into the stack than needed and may affect other uses of that
method.<br><br>
There's an existing JDK bug on this coming at it from a different
direction - 6763530 ... and there may be considerations at <br>
<pre>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=480280" eudora="autourl">
https://bugzilla.mozilla.org/show_bug.cgi?id=480280
</a></pre> that should be looked at. Also see 6779460 which is
mostly a duplicate of 6763530.<br><br>
<br>
It's probable that the fix I suggested at 6763530 (in comments
submitted 29 Nov 08) may be a better approach given the NSS fixes.
I believe it will fix the keytool problem noted in the original
message.<br><br>
Mike<br><br>
<br><br>
<br><br>
At 04:39 PM 9/1/2009, Joe Darcy wrote:<br>
<blockquote type=cite class=cite cite="">Andrew John Hughes wrote:<br>
<blockquote type=cite class=cite cite="">2009/8/28 Andrew John Hughes
<gnu_andrew@member.fsf.org>:<br>
<blockquote type=cite class=cite cite="">In OpenJDK6, the elliptic curve
cryptography algorithms are available<br>
if the PKCS11 provider is configured to point to NSS. See:<br><br>
<a href="http://blogs.sun.com/andreas/entry/the_java_pkcs_11_provider" eudora="autourl">
http://blogs.sun.com/andreas/entry/the_java_pkcs_11_provider</a><br><br>
If NSS is configured as specified in this blog, keytool can be used
to<br>
generate a key as follows:</blockquote></blockquote><br>
Hello.<br><br>
Allowing keytool and friends to work in more cases if the provider is
capable seems fine to me.<br><br>
Security team, do you have concerns about this patch?<br><br>
Thanks,<br><br>
-Joe</blockquote></body>
<br>
</html>