<html><head></head><body dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="ApplePlainTextBody"><div class="ApplePlainTextBody"><br><blockquote type="cite">On Aug 8, 2017, at 8:22 PM, Sean Mullan <sean.mullan@oracle.com> wrote:<br><br>I don't think we should warn at all if the keysize cannot be determined or is inaccessible. The corresponding algorithm constraints checks don't restrict keys whose size cannot be determined, so keytool and jarsigner should be consistent.<br></blockquote><br>This code change is not related to weak warnings. For jarsigner, it's the signing history:<br><br><blockquote type="cite">- Signed by "CN=a"<br> Digest algorithm: SHA-256<br> Signature algorithm: SHA256withECDSA, -1-bit key<br></blockquote><br>For keytool, it's the keytool -list -v output:<br><br><blockquote type="cite">Alias name: a<br>...<br>Signature algorithm name: SHA256withECDSA<br>Subject Public Key Algorithm: -1-bit EC key<br>Version: 3<br></blockquote><br>In fact, whenever the key size appears in a weak warning, as you said, it's always a positive value that fails a constraint check. This is why I said I haven't touched those KeyUtil.getSize() outputs.<br><br>--Max<br><br><blockquote type="cite"><br>--Sean<br><br>On 8/8/17 1:49 AM, Weijun Wang wrote:<br><blockquote type="cite">Please review this trivial fix at<br> http://cr.openjdk.java.net/~weijun/8185934/webrev.00/<br>KeyUtil.getSize() are also called elsewhere when they key is weak, where key length is not -1.<br>Noreg-trivial.<br>Thanks<br>Max<br></blockquote></blockquote><br></div></body></html>