<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Sean,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">thank you for your quick reply. I was already hoping to get such feedback.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I had read the CSR and I had already thought that you guys didn’t revert the complete change.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">My problem is that I can’t see what exactly you have done.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I’m concerned about making it insecure by creating a mixture of old and new behavior. How can I ensure to get the same behavior as 11.0.12-oracle?</span><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Would it be possible to publish your security file and PKCS12KeyStore.java?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Otherwise, wouldn’t it be safer to stick with the old behavior until we switch to the new one in a future release?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Martin<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">Von:
</span></b><span style="font-size:12.0pt;color:black">Seán Coffey <sean.coffey@oracle.com><br>
<b>Datum: </b>Freitag, 28. Mai 2021 um 15:42<br>
<b>An: </b>Doerr, Martin <martin.doerr@sap.com>, jdk-updates-dev@openjdk.java.net <jdk-updates-dev@openjdk.java.net>, security-dev <security-dev@openjdk.java.net>, Hohensee, Paul <hohensee@amazon.com><br>
<b>Betreff: </b>Re: [11u] RFR: 8267599: Revert the change to the default PKCS12 macAlgorithm and macIterationCount props for 11u/8u/7u<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Martin,<br>
<br>
you seem to be suggesting a full revert of the JDK-8153005 changes. Note <br>
that the Oracle JDK changes only relate to to the default PKCS12 <br>
macAlgorithm and macIterationCount (back to HmacPBESHA1 and 100000 <br>
respectively). While there are other interoperability concerns with the <br>
keystore.pkcs12.certProtectionAlgorithm and <br>
keystore.pkcs12.keyProtectionAlgorithm values [1], they relate to JDK <br>
8u/7u where PKCS12 is not the default keystore type.<br>
<br>
regards,<br>
Sean.<br>
<br>
[1] <a href="https://bugs.openjdk.java.net/browse/JDK-8267837">https://bugs.openjdk.java.net/browse/JDK-8267837</a><br>
<br>
On 28/05/2021 13:52, Doerr, Martin wrote:<br>
> Hi,<br>
><br>
> Oracle has reverted the changes from JDK-8153005 backport in 11.0.12-oracle for interoperability reasons. See:<br>
> <a href="https://bugs.openjdk.java.net/browse/JDK-8267599">https://bugs.openjdk.java.net/browse/JDK-8267599</a><br>
> and CSR:<br>
> <a href="https://bugs.openjdk.java.net/browse/JDK-8267701">https://bugs.openjdk.java.net/browse/JDK-8267701</a><br>
><br>
> I had to adapt the small test addition from JDK-8266293 (see "// 8266293" comment in ParamsPreferences.java):<br>
> <a href="http://cr.openjdk.java.net/~mdoerr/8267599_revert_8153005_11u/webrev.00/">
http://cr.openjdk.java.net/~mdoerr/8267599_revert_8153005_11u/webrev.00/</a><br>
><br>
> Please review.<br>
> Comments?<br>
><br>
> Best regards,<br>
> Martin<br>
><o:p></o:p></p>
</div>
</div>
</body>
</html>