RFR: 8296442: EncryptedPrivateKeyInfo can be created with an uninitialized AlgorithmParameters [v3]

Sean Mullan mullan at openjdk.org
Tue Nov 15 21:56:38 UTC 2022


On Thu, 10 Nov 2022 15:03:21 GMT, Weijun Wang <weijun at openjdk.org> wrote:

>> src/java.base/share/classes/sun/security/x509/AlgorithmId.java line 113:
>> 
>>> 111:             } catch (IOException ioe) {
>>> 112:                 throw new IllegalStateException(
>>> 113:                         "AlgorithmParameters not initialized", ioe);
>> 
>> Did you have a chance to look at the caller and make sure this behavioral update is safe?
>
> The only left caller is `EncryptedPrivateKeyInfo`. If new callers start using this constructor, this will be the expected behavior. The message can be enhanced a little since there could be other reasons. (Ex: `PSSParameters` with unknown hash algorithms).

Would it be more correct to change the message to "AlgorithmParameters are not initialized or cannot be decoded"?

-------------

PR: https://git.openjdk.org/jdk/pull/11067


More information about the security-dev mailing list