<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jul 20, 2022, at 7:00 AM, Michael StJohns <<a href="mailto:mstjohns@comcast.net" class="">mstjohns@comcast.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Hi Ravi -<span class="Apple-converted-space"> </span><br class=""></div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Not speaking for the openjdk folk, I would expect you would be better off implementing this as an external KeyStore provider yourself as I would guess there isn't a broad demand for something that meets your requirements at this point.</div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div></div></blockquote><div>+1.</div><div><br class=""></div><div>Xuelei</div><br class=""><blockquote type="cite" class=""><div class=""><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Later, Mike</div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">On 7/20/2022 6:39 AM, Ravi Patel8 wrote:<br class=""></div><blockquote type="cite" cite="mid:BN7PR15MB2321C89DF26D49D1C42AE215A58E9@BN7PR15MB2321.namprd15.prod.outlook.com" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Hi Mike and <span style="font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;" class="">Xuelei,<br class=""><br class=""></span></div><div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><span style="font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;" class=""><span style="font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important;" class="">Thank you for the suggested solutions with an added attribute and a new provider. Do you think it is something that could be contributed to the JDK, or do you suggest this should be taken up as an external provider?</span><br class=""></span></div><hr tabindex="-1" style="display: inline-block; width: 949.609375px;" class=""><div id="divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" style="font-size: 11pt;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>Ravi Patel8<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:Ravi.Patel8@ibm.com"><Ravi.Patel8@ibm.com></a><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 14, 2022 6:26 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Xuelei Fan<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:xuelei.f@gmail.com"><xuelei.f@gmail.com></a>; Michael StJohns<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:mstjohns@comcast.net"><mstjohns@comcast.net></a><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:security-dev@openjdk.org">security-dev@openjdk.org</a><span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:security-dev@openjdk.org"><security-dev@openjdk.org></a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [EXTERNAL] Re: Case-sensitive Keystore for PKCS#12</font><div class="elementToProof"> </div></div><div dir="ltr" class=""><div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Thank you for the suggested solutions with an added attribute and a new provider. Do you think it is something that could be contributed to the JDK, or do you suggest this should be taken up as an external provider?<br class=""></div><hr tabindex="-1" style="display: inline-block; width: 949.609375px;" class=""><div id="x_divRplyFwdMsg" dir="ltr" class=""><font class="elementToProof" face="Calibri, sans-serif" style="font-size: 11pt;"><b class="">From:</b><span class="Apple-converted-space"> </span>security-dev<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:security-dev-retn@openjdk.org"><security-dev-retn@openjdk.org></a><span class="Apple-converted-space"> </span>on behalf of Xuelei Fan<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:xuelei.f@gmail.com"><xuelei.f@gmail.com></a><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 14, 2022 3:10 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Michael StJohns<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:mstjohns@comcast.net"><mstjohns@comcast.net></a><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:security-dev@openjdk.org">security-dev@openjdk.org</a><span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:security-dev@openjdk.org"><security-dev@openjdk.org></a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[EXTERNAL] Re: Case-sensitive Keystore for PKCS#12</font><div class=""> </div></div><div class="x_BodyFragment"><font size="2" class=""><span style="font-size: 11pt;" class=""><div class="x_PlainText elementToProof"><br class=""><br class="">> On Jul 13, 2022, at 2:20 PM, Michael StJohns<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:mstjohns@comcast.net"><mstjohns@comcast.net></a><span class="Apple-converted-space"> </span>wrote:<br class="">><span class="Apple-converted-space"> </span><br class="">> On 7/13/2022 3:26 PM, Xuelei Fan wrote:<br class="">>> Is it possible make it in the application layer? For example, mapping case-sensitive name to case-in-sensitive name before calling into the standard KeyStore APIs. It may be not good to break the standards for corner cases?<br class="">>><span class="Apple-converted-space"> </span><br class="">>> Xuelei<br class="">><span class="Apple-converted-space"> </span><br class="">> Hi Xuelei -<br class="">><span class="Apple-converted-space"> </span><br class="">> It wouldn't actually be breaking the PKCS12 spec - the addition of more attributes is part of the standard.<br class="">I agreed it could not break PKCS12 spec. I referred to the friendlyName spec in PKCS12. An additional attribute could be used for the case-in-sensitive name support. But there is a need to define and support the attribute in the KeyStore implementation, just as you described in your previous reply.<br class=""><br class=""><br class="">> Nor, given the CaseExactJKS implementation, would it be breaking the JDK spec AFAICT. There is this in the KeyStore javadoc:<br class="">><span class="Apple-converted-space"> </span><br class="">>> Whether aliases are case sensitive is implementation dependent. In order to avoid problems, it is recommended not to use aliases in a KeyStore that only differ in case.<span class="Apple-converted-space"> </span><br class="">> The approach you suggest wouldn't work, because you couldn't store one key with "MikesKey" and another with "MIKESKEY" in the Keystore.<br class="">><span class="Apple-converted-space"> </span><br class=""><br class="">I did not meant to cover the case. It may be fine to use a map, in which “MikesKey” may be mapped to “mikeskkey-1000100”, and MIKESKEY to “mikeskkey-0000000”, or something else like you described below ("Mike" -> "04mike8”).<br class=""><br class="">Xuelei<br class=""><br class=""><br class="">> Hmm - let me rephrase that slightly. You could use this approach, but not in the way you suggested. Instead, you'd need a transform from a String to a unique string that you could use inside the key store. The actual alias within the keystore would be the unique string.<br class="">><span class="Apple-converted-space"> </span><br class="">> One way of doing that: Lowercase the string. Prepend the string with a 2 character length field. Post pend the string with a hex field of CEIL(length/16) characters, each hex character representing 16 bits that indicate the case of the string.<br class="">><span class="Apple-converted-space"> </span><br class="">> e.g. "Mike" -> "04mike8"<br class="">><span class="Apple-converted-space"> </span><br class="">> Just a thought - Mike<br class="">><span class="Apple-converted-space"> </span><br class="">>><span class="Apple-converted-space"> </span><br class="">>>> On Jul 13, 2022, at 4:38 AM, Ravi Patel8<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:Ravi.Patel8@ibm.com"><Ravi.Patel8@ibm.com></a><span class="Apple-converted-space"> </span>wrote:<br class="">>>><span class="Apple-converted-space"> </span><br class="">>>> We have a customer who is having a security requirement. He wants to know, Is it possible to have case-sensitive support for PKCS#12? We referred the RFCs for PKCS#12. We found that PKCS#12 uses a case in-sensitive alias and the alias Name is mapped with friendlyName attribute, which is specified as "caseIgnoreMatch" as below.<br class="">>>><span class="Apple-converted-space"> </span><br class="">>>> friendlyName ATTRIBUTE ::= {<br class="">>>> WITH SYNTAX BMPString (SIZE(1..pkcs-9-ub-friendlyName))<br class="">>>> EQUALITY MATCHING RULE caseIgnoreMatch<br class="">>>> SINGLE VALUE TRUE<br class="">>>> ID pkcs-9-at-friendlyName<br class="">>>> }<br class="">>>><span class="Apple-converted-space"> </span><br class="">>>> The RFCs can be found here:<br class="">>>><span class="Apple-converted-space"> </span><a href="https://datatracker.ietf.org/doc/html/rfc7292" data-auth="NotApplicable" moz-do-not-send="true" class="moz-txt-link-freetext">https://datatracker.ietf.org/doc/html/rfc7292</a><span class="Apple-converted-space"> </span><br class="">>>><span class="Apple-converted-space"> </span><a href="https://datatracker.ietf.org/doc/html/rfc2985#page-19" data-auth="NotApplicable" moz-do-not-send="true" class="moz-txt-link-freetext">https://datatracker.ietf.org/doc/html/rfc2985#page-19</a><span class="Apple-converted-space"> </span><br class="">>>><span class="Apple-converted-space"> </span><br class="">>>> The JKS key store(case in-sensitive alias) has a special version (CaseExactJKS) that uses case sensitive aliases.<br class="">>>> So similarly, Will it be acceptable to have a case sensitive version of PKCS#12 as CaseExactPKCS12 which will use case sensitive aliases?<br class="">><span class="Apple-converted-space"> </span><br class="">><span class="Apple-converted-space"> </span></div></span></font></div></div></blockquote></div></blockquote></div><br class=""></body></html>