<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_compose-container" itemscope="" itemtype="https://schema.org/EmailMessage" style="direction:ltr">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span>
<div>
<div>
<div>Hello,</div>
<div><br>
</div>
<div style="direction:ltr">Is the following comment correct, it looks like it should read „with NUL terminator“ instead?</div>
<div><br>
</div>
<div style="direction:ltr">// without a NULL terminator</div>
<div><br>
</div>
<div style="direction:ltr">Greetings</div>
<div style="direction:ltr">Bernd</div>
</div>
<div><br>
</div>
<div class="x_acompli_signature">
<div style="direction:ltr">Gruss</div>
<div style="direction:ltr">Bernd</div>
<div style="direction:ltr">-- </div>
<div style="direction:ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> security-dev <security-dev-bounces@openjdk.java.net> on behalf of Weijun Wang <weijun.wang@oracle.com><br>
<b>Sent:</b> Friday, April 27, 2018 6:56:03 PM<br>
<b>To:</b> security-dev@openjdk.java.net<br>
<b>Subject:</b> RFR 8202299: Java Keystore fails to load PKCS12/PFX certificates created in WindowsServer2016</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">Please take a look at<br>
<br>
<a href="http://cr.openjdk.java.net/~weijun/8202299/webrev.00/">http://cr.openjdk.java.net/~weijun/8202299/webrev.00/</a><br>
<br>
Turns out we have to retry [0] other than [] in all 3 locations: decrypting keys, decrypting certs, and verifying the mac.<br>
<br>
Thanks<br>
Max<br>
<br>
p.s. You might wonder why suddenly in Windows Server 2016, Microsoft starts using [0] to generate the Mac. In fact, they have been doing this all the time. However, before 2016, they also encrypted the certificates, and to decrypt them, Java has already changed
password from [] to [0].<br>
<br>
p.p.s. But is this correct? Should the certificate decryption code only temporarily retries [0] but not changing password itself? Well, maybe. But unless a weird software sometimes uses [] and sometimes [0], this will not be a problem, and changing password
itself saves us some cycles from always trying twice.</div>
</span></font>
</body>
</html>