<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Hi Sean,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">thank you very much!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I was concerned to miss anything. But it is really that simple
</span><span lang="EN-US" style="font-family:"Apple Color Emoji";mso-fareast-language:EN-US">😊</span><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I’ll prepare a new webrev.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Martin<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">Von:
</span></b><span style="font-size:12.0pt;color:black">Seán Coffey <sean.coffey@oracle.com><br>
<b>Datum: </b>Freitag, 28. Mai 2021 um 16:36<br>
<b>An: </b>Doerr, Martin <martin.doerr@sap.com>, jdk-updates-dev@openjdk.java.net <jdk-updates-dev@openjdk.java.net>, security-dev <security-dev@openjdk.java.net>, Hohensee, Paul <hohensee@amazon.com><br>
<b>Betreff: </b>Re: [External] : AW: [11u] RFR: 8267599: Revert the change to the default PKCS12 macAlgorithm and macIterationCount props for 11u/8u/7u<o:p></o:p></span></p>
</div>
<p class="MsoNormal">here are the main changes that we pushed for JDK 11u:<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre style="font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;overflow-wrap: break-word;white-space:pre-wrap;word-spacing:0px"><span style="color:black">diff --git a/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java b/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java<o:p></o:p></span></pre>
<pre><span style="color:black">index a62452bdcd..441f2b651e 100644<o:p></o:p></span></pre>
<pre><span style="color:black">--- a/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java<o:p></o:p></span></pre>
<pre><span style="color:black">+++ b/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java<o:p></o:p></span></pre>
<pre><span style="color:black">@@ -101,10 +101,10 @@ public final class PKCS12KeyStore extends KeyStoreSpi {<o:p></o:p></span></pre>
<pre><span style="color:black"> = "PBEWithHmacSHA256AndAES_256";<o:p></o:p></span></pre>
<pre><span style="color:black"> private static final String DEFAULT_KEY_PBE_ALGORITHM<o:p></o:p></span></pre>
<pre><span style="color:black"> = "PBEWithHmacSHA256AndAES_256";<o:p></o:p></span></pre>
<pre><span style="color:black">- private static final String DEFAULT_MAC_ALGORITHM = "HmacPBESHA256";<o:p></o:p></span></pre>
<pre><span style="color:black">+ private static final String DEFAULT_MAC_ALGORITHM = "HmacPBESHA1";<o:p></o:p></span></pre>
<pre><span style="color:black"> private static final int DEFAULT_CERT_PBE_ITERATION_COUNT = 10000;<o:p></o:p></span></pre>
<pre><span style="color:black"> private static final int DEFAULT_KEY_PBE_ITERATION_COUNT = 10000;<o:p></o:p></span></pre>
<pre><span style="color:black">- private static final int DEFAULT_MAC_ITERATION_COUNT = 10000;<o:p></o:p></span></pre>
<pre><span style="color:black">+ private static final int DEFAULT_MAC_ITERATION_COUNT = 100000;<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> // Legacy settings. Used when "keystore.pkcs12.legacy" is set.<o:p></o:p></span></pre>
<pre><span style="color:black"> private static final String LEGACY_CERT_PBE_ALGORITHM<o:p></o:p></span></pre>
<pre><span style="color:black">diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security<o:p></o:p></span></pre>
<pre><span style="color:black">index b0c5beccf6..893567071c 100644<o:p></o:p></span></pre>
<pre><span style="color:black">--- a/src/java.base/share/conf/security/java.security<o:p></o:p></span></pre>
<pre><span style="color:black">+++ b/src/java.base/share/conf/security/java.security<o:p></o:p></span></pre>
<pre><span style="color:black">@@ -1200,12 +1200,12 @@ jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep<o:p></o:p></span></pre>
<pre><span style="color:black"> # The algorithm used to calculate the optional MacData at the end of a PKCS12<o:p></o:p></span></pre>
<pre><span style="color:black"> # file. This can be any HmacPBE algorithm defined in the Mac section of the<o:p></o:p></span></pre>
<pre><span style="color:black"> # Java Security Standard Algorithm Names Specification. When set to "NONE",<o:p></o:p></span></pre>
<pre><span style="color:black">-# no Mac is generated. The default value is "HmacPBESHA256".<o:p></o:p></span></pre>
<pre><span style="color:black">-#keystore.pkcs12.macAlgorithm = HmacPBESHA256<o:p></o:p></span></pre>
<pre><span style="color:black">+# no Mac is generated. The default value is "HmacPBESHA1".<o:p></o:p></span></pre>
<pre><span style="color:black">+#keystore.pkcs12.macAlgorithm = HmacPBESHA1<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> # The iteration count used by the MacData algorithm. This value must be a<o:p></o:p></span></pre>
<pre><span style="color:black">-# positive integer. The default value is 10000.<o:p></o:p></span></pre>
<pre><span style="color:black">-#keystore.pkcs12.macIterationCount = 10000<o:p></o:p></span></pre>
<pre><span style="color:black">+# positive integer. The default value is 100000.<o:p></o:p></span></pre>
<pre><span style="color:black">+#keystore.pkcs12.macIterationCount = 100000<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> #<o:p></o:p></span></pre>
<pre><span style="color:black"> # Enhanced exception message information<o:p></o:p></span></pre>
</blockquote>
<p>regards,<br>
Sean.<o:p></o:p></p>
<div>
<p class="MsoNormal">On 28/05/2021 15:02, Doerr, Martin wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Sean,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">thank you for your quick reply. I was already hoping to get such feedback.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I had read the CSR and I had already thought that you guys didn’t revert the complete change.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">My problem is that I can’t see what exactly you have done.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I’m concerned about making it insecure by creating a mixture of old and new behavior. How can I ensure to get the same behavior as 11.0.12-oracle?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Would it be possible to publish your security file and PKCS12KeyStore.java?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Otherwise, wouldn’t it be safer to stick with the old behavior until we switch to the new one in a future release?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Best regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Martin</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">Von:
</span></b><span style="font-size:12.0pt;color:black">Seán Coffey <a href="mailto:sean.coffey@oracle.com">
<sean.coffey@oracle.com></a><br>
<b>Datum: </b>Freitag, 28. Mai 2021 um 15:42<br>
<b>An: </b>Doerr, Martin <a href="mailto:martin.doerr@sap.com"><martin.doerr@sap.com></a>,
<a href="mailto:jdk-updates-dev@openjdk.java.net">jdk-updates-dev@openjdk.java.net</a>
<a href="mailto:jdk-updates-dev@openjdk.java.net"><jdk-updates-dev@openjdk.java.net></a>, security-dev
<a href="mailto:security-dev@openjdk.java.net"><security-dev@openjdk.java.net></a>, Hohensee, Paul
<a href="mailto:hohensee@amazon.com"><hohensee@amazon.com></a><br>
<b>Betreff: </b>Re: [11u] RFR: 8267599: Revert the change to the default PKCS12 macAlgorithm and macIterationCount props for 11u/8u/7u</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Martin,<br>
<br>
you seem to be suggesting a full revert of the JDK-8153005 changes. Note <br>
that the Oracle JDK changes only relate to to the default PKCS12 <br>
macAlgorithm and macIterationCount (back to HmacPBESHA1 and 100000 <br>
respectively). While there are other interoperability concerns with the <br>
keystore.pkcs12.certProtectionAlgorithm and <br>
keystore.pkcs12.keyProtectionAlgorithm values [1], they relate to JDK <br>
8u/7u where PKCS12 is not the default keystore type.<br>
<br>
regards,<br>
Sean.<br>
<br>
[1] <a href="https://bugs.openjdk.java.net/browse/JDK-8267837">https://bugs.openjdk.java.net/browse/JDK-8267837</a><br>
<br>
On 28/05/2021 13:52, Doerr, Martin wrote:<br>
> Hi,<br>
><br>
> Oracle has reverted the changes from JDK-8153005 backport in 11.0.12-oracle for interoperability reasons. See:<br>
> <a href="https://bugs.openjdk.java.net/browse/JDK-8267599">https://bugs.openjdk.java.net/browse/JDK-8267599</a><br>
> and CSR:<br>
> <a href="https://bugs.openjdk.java.net/browse/JDK-8267701">https://bugs.openjdk.java.net/browse/JDK-8267701</a><br>
><br>
> I had to adapt the small test addition from JDK-8266293 (see "// 8266293" comment in ParamsPreferences.java):<br>
> <a href="http://cr.openjdk.java.net/~mdoerr/8267599_revert_8153005_11u/webrev.00/">
http://cr.openjdk.java.net/~mdoerr/8267599_revert_8153005_11u/webrev.00/</a><br>
><br>
> Please review.<br>
> Comments?<br>
><br>
> Best regards,<br>
> Martin<br>
><o:p></o:p></p>
</div>
</blockquote>
</div>
</body>
</html>