<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi, Max,<br>
<br>
Looks good, no further comments.<br>
Thanks,<br>
Valerie<br>
<br>
On 03/01/10 16:54, Max (Weijun) Wang wrote:
<blockquote cite="mid:3A4C9B54-C867-4D00-9A0A-0FF64230604D@Sun.COM"
type="cite">
<pre wrap="">Hi Valerie
Thanks! All suggestions accepted.
Webrev updated at <a class="moz-txt-link-freetext" href="http://cr.openjdk.java.net/~weijun/6844909/webrev.01">http://cr.openjdk.java.net/~weijun/6844909/webrev.01</a>
Thanks again
Max
On Mar 2, 2010, at 8:44 AM, Valerie Peng wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi, Max,
Changes look fine, here are some minor comments:
1) In EType.java, line 60, 64 should be indented w/ one extra space.
2) In EType.java, there should be comments added to "BUILTIN_ETYPES", and "BUILTIN_ETYPES_NOAES256" mentioning about the first two entries are removed when ALLOW_WEAK_CRYPTO is false.
3) In EType.java, line 235 and 236 still mentions these weak crypto etypes regardless. Shouldn't it be updated?
Thanks,
Valerie
On 02/28/10 23:07, Max (Weijun) Wang wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Valerie
Can you please take a review on this fix?
<a class="moz-txt-link-freetext" href="http://cr.openjdk.java.net/~weijun/6844909/webrev.00">http://cr.openjdk.java.net/~weijun/6844909/webrev.00</a>
Basically, when "allow_weak_crypto = false" is set in krb5.conf's [libdefaults], DES-related etypes will not be used. Note that this setting also removes any weak etypes in the default_*_enctypes settings. This config was added in MIT's krb5-1.7 and defaults to false in 1.8. However, for compatibility (which we care a lot in Java), its default value is still true in Java.
Thanks
Max
</pre>
<blockquote type="cite">
<pre wrap="">*Change Request ID*: 6844909
*Synopsis*: support allow_weak_crypto in krb5.conf
=== *Description* ============================================================
Latest MIT krb5 supports a allow_weak_crypto key in krb5.conf, when set to true, disallows DES be used in all kinds of etypes. We can support it also.
Currently, MIT krb5's default value for this key is false, but it might become true one day.
</pre>
</blockquote>
<pre wrap="">It's true in 1.8 now.
</pre>
<blockquote type="cite">
<pre wrap="">*** (#1 of 1): 2009-05-26 03:50:36 GMT+00:00 <a class="moz-txt-link-abbreviated" href="mailto:weijun.wang@sun.com">weijun.wang@sun.com</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
<br>
</body>
</html>