<html>
<body>
In KeyStore.java -<br><br>
Attribute should probably be abstract rather than interface - mainly
because you need to define equals properly to honor the Set contract for
an attribute. E.g. the equals is only against the "name"
- not the encoded name/value. This can be overridden
later.<br><br>
In PKCS12Attribute - line 194 - a simple compare against the OID
value of type is probably where you want to go here. Otherwise you
can have multiple Attributes with the same type, but different
values.<br><br>
<br>
There's something wrong with your definition of the trusted key attribute
- I think. See below.<br><br>
<br><br>
At 10:18 AM 1/21/2013, Vincent Ryan wrote:<br>
<blockquote type=cite class=cite cite="">Hello,<br><br>
Please review the fix for 8005408. It adds support for associating
attributes with keystore entries.<br>
It is yet another component of the JEP-166 delivery.<br><br>
This new API permits several enhancements to the PKCS12 keystore
implementation: the storage of<br>
trusted certificates, storage of secret keys and support for entry
metadata. Currently, only the<br>
PKCS12 keystore takes advantage of these new KeyStore APIs.<br><br>
Webrev:
<a href="http://cr.openjdk.java.net/~vinnie/8005408/webrev.00/">
http://cr.openjdk.java.net/~vinnie/8005408/webrev.00/</a><br><br>
<br>
For storing trusted certificates in PKCS12 a new SafeBag attribute (with
a familiar syntax) is introduced<br>
to indicate a trust usage:<br><br>
trustedKeyUsage ATTRIBUTE ::= {<br>
WITH SYNTAX ExtKeyUsageSyntax<br>
ID id-at-trustedKeyUsage -- object identifier
from an Oracle arc<br>
}<br>
<br>
-- from RFC 5832, Section 4.2.1.12<br>
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF
KeyPurposeId <br>
KeyPurposeId ::= OBJECT IDENTIFIER<br>
anyExtendedKeyUsage OBJECT IDENTIFIER ::= {
id-ce-extKeyUsage 0 }</blockquote><br><br>
What I think you want as an encoding is <br><br>
SEQUENCE {<br>
id-at-trustedCert,<br>
SET of {<br>
<x-tab> </x-tab>BOOLEAN
DEFAULT TRUE<br>
}<br>
}<br><br>
Or basically the oid with an empty set under it. Don't use
ExtKeyUsage as the syntax. Its probably incorrect for what you're
trying to accomplish.<br><br>
TrustedCert :: BOOLEAN DEFAULT TRUE<br><br>
trustedCertAttribute ATTRIBUTE ::= {<br>
ID id-at-trustedCert,<br>
WITH SYNTAX TrustedCert<br>
}<br><br>
Alternately, use a syntax of NULL.<br><br>
Try to get a real OID allocation for id-at-trustedCert before this goes
final.<br><br>
<br><br>
<blockquote type=cite class=cite cite="">Note that this approach does not
preclude the storage of a Trust Anchor List (as defined in RFC 5914)<br>
which was proposed earlier on this list.<br><br>
<br>
There is one omission from the webrev above: the
java.security.PKCS12Attribute class needs some<br>
additional changes and will be posted shortly.<br><br>
Again, JEP-166 is on a tight schedule for M6 so your early comments are
appreciated.<br><br>
Thanks.</blockquote></body>
<br>
</html>