<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>Thanks for your comments Michael. Your suggestions involve API changes that I cannot accommodate</div><div>in time for Milestone 6. I will address these issues following M6 and have filed the following bug report</div><div>to track that task:</div><div><br></div><div>8006796: Address additional review comments for 8005408</div><div><span style="color: rgb(51, 51, 51); font-family: Arial, FreeSans, Helvetica, sans-serif; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 17px; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(221, 250, 222); display: inline !important; float: none; "><br></span></div><div><br></div><div>BTW the current syntax for the trustedKeyUsage attribute is designed to enable certs to be marked as</div><div>trusted for limited purposes. Your suggestion delivers a simpler syntax but loses this feature.</div><div><br></div><div><br></div><div><br></div><br><div><div>On 23 Jan 2013, at 17:42, Michael StJohns wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<div>
In KeyStore.java -<br><br>
Attribute should probably be abstract rather than interface - mainly
because you need to define equals properly to honor the Set contract for
an attribute. E.g. the equals is only against the "name"
- not the encoded name/value. This can be overridden
later.<br><br>
In PKCS12Attribute - line 194 - a simple compare against the OID
value of type is probably where you want to go here. Otherwise you
can have multiple Attributes with the same type, but different
values.<br><br>
<br>
There's something wrong with your definition of the trusted key attribute
- I think. See below.<br><br>
<br><br>
At 10:18 AM 1/21/2013, Vincent Ryan wrote:<br>
<blockquote type="cite" class="cite" cite="x-msg://716/">Hello,<br><br>
Please review the fix for 8005408. It adds support for associating
attributes with keystore entries.<br>
It is yet another component of the JEP-166 delivery.<br><br>
This new API permits several enhancements to the PKCS12 keystore
implementation: the storage of<br>
trusted certificates, storage of secret keys and support for entry
metadata. Currently, only the<br>
PKCS12 keystore takes advantage of these new KeyStore APIs.<br><br>
Webrev:
<a href="http://cr.openjdk.java.net/~vinnie/8005408/webrev.00/">
http://cr.openjdk.java.net/~vinnie/8005408/webrev.00/</a><br><br>
<br>
For storing trusted certificates in PKCS12 a new SafeBag attribute (with
a familiar syntax) is introduced<br>
to indicate a trust usage:<br><br>
trustedKeyUsage ATTRIBUTE ::= {<br>
WITH SYNTAX ExtKeyUsageSyntax<br>
ID id-at-trustedKeyUsage -- object identifier
from an Oracle arc<br>
}<br>
<br>
-- from RFC 5832, Section 4.2.1.12<br>
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF
KeyPurposeId <br>
KeyPurposeId ::= OBJECT IDENTIFIER<br>
anyExtendedKeyUsage OBJECT IDENTIFIER ::= {
id-ce-extKeyUsage 0 }</blockquote><br><br>
What I think you want as an encoding is <br><br>
SEQUENCE {<br>
id-at-trustedCert,<br>
SET of {<br>
<x-tab> </x-tab>BOOLEAN
DEFAULT TRUE<br>
}<br>
}<br><br>
Or basically the oid with an empty set under it. Don't use
ExtKeyUsage as the syntax. Its probably incorrect for what you're
trying to accomplish.<br><br>
TrustedCert :: BOOLEAN DEFAULT TRUE<br><br>
trustedCertAttribute ATTRIBUTE ::= {<br>
ID id-at-trustedCert,<br>
WITH SYNTAX TrustedCert<br>
}<br><br>
Alternately, use a syntax of NULL.<br><br>
Try to get a real OID allocation for id-at-trustedCert before this goes
final.<br><br>
<br><br>
<blockquote type="cite" class="cite" cite="x-msg://716/">Note that this approach does not
preclude the storage of a Trust Anchor List (as defined in RFC 5914)<br>
which was proposed earlier on this list.<br><br>
<br>
There is one omission from the webrev above: the
java.security.PKCS12Attribute class needs some<br>
additional changes and will be posted shortly.<br><br>
Again, JEP-166 is on a tight schedule for M6 so your early comments are
appreciated.<br><br>
Thanks.</blockquote></div>
<br>
</blockquote></div><br></body></html>