Re: RFR: 8352728: InternalError loading java.security due to Windows parent folder permissions [v2]

2025-04-16 Thread Martin Balao
On Tue, 15 Apr 2025 18:38:20 GMT, Francisco Ferrari Bihurriet wrote: >> Hi, this is a proposal to fix 8352728. >> >> The main idea is to replace >> [`java.nio.file.Path::toRealPath`](https://docs.oracle.com/en/java/javase/24/docs/api/java.base/java/nio/file/Path.html#toRealPath(java.nio.file.L

Re: RFR: 8350661: PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key [v3]

2025-04-16 Thread Martin Balao
On Thu, 17 Apr 2025 00:22:14 GMT, Martin Balao wrote: >> Hi, >> >> I would like to request a review for the fix of JDK-8350661. In this fix, we >> translate the native PKCS 11 error code into an >> `InvalidAlgorithmParameterException`, as documented in the `KDF::deriveKey` >> API. With that s

Re: RFR: 8350661: PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key [v3]

2025-04-16 Thread Martin Balao
On Thu, 17 Apr 2025 00:47:00 GMT, Valerie Peng wrote: >> Martin Balao has updated the pull request incrementally with two additional >> commits since the last revision: >> >> - TLS keys added to the map. >> - Key type check refactoring (derivation). > > src/jdk.crypto.cryptoki/share/classes/s

Re: RFR: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled [v11]

2025-04-16 Thread Artur Barashev
On Wed, 16 Apr 2025 22:01:04 GMT, Mark Powers wrote: >> Artur Barashev has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Further optimization: remove unnecessary updates > > test/jdk/sun/security/ssl/SignatureScheme/MD5NotAllowedInTLS13Cer

Re: RFR: 8350661: PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key [v3]

2025-04-16 Thread Valerie Peng
On Thu, 17 Apr 2025 00:22:14 GMT, Martin Balao wrote: >> Hi, >> >> I would like to request a review for the fix of JDK-8350661. In this fix, we >> translate the native PKCS 11 error code into an >> `InvalidAlgorithmParameterException`, as documented in the `KDF::deriveKey` >> API. With that s

Re: RFR: 8350661: PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key [v3]

2025-04-16 Thread Martin Balao
> Hi, > > I would like to request a review for the fix of JDK-8350661. In this fix, we > translate the native PKCS 11 error code into an > `InvalidAlgorithmParameterException`, as documented in the `KDF::deriveKey` > API. With that said, different PKCS 11 libraries may throw different errors >

Re: RFR: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled [v11]

2025-04-16 Thread Mark Powers
On Wed, 16 Apr 2025 14:57:20 GMT, Artur Barashev wrote: >> MD5 algorithm is prohibited by TLSv1.3 RFC to be used in certificates: >> >> >> Any endpoint receiving any certificate which it would need to >> validate using any signature algorithm using an MD5 hash MUST abort >> the handshake with a

Re: RFR: 8350661: PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key [v2]

2025-04-16 Thread Valerie Peng
On Mon, 14 Apr 2025 19:01:45 GMT, Francisco Ferrari Bihurriet wrote: >> As far as I understand it, `HmacSHA256` is blocked, but not >> `PBEWithHmacSHA224AndAES_256`. >> >> ### `HmacSHA256` >> >> * Has an `HMACKeyInfo` entry with the following non-static fields: >> * `KeyInfo.algo` = `"Hma

Re: RFR: 8349721: Add aarch64 intrinsics for ML-KEM [v11]

2025-04-16 Thread Vladimir Ivanov
On Tue, 15 Apr 2025 18:18:36 GMT, Ferenc Rakoczi wrote: >> By using the aarch64 vector registers the speed of the computation of the >> ML-KEM algorithms (key generation, encapsulation, decapsulation) can be >> approximately doubled. > > Ferenc Rakoczi has updated the pull request incrementally

Re: RFR: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled [v11]

2025-04-16 Thread Sean Mullan
On Wed, 16 Apr 2025 14:57:20 GMT, Artur Barashev wrote: >> MD5 algorithm is prohibited by TLSv1.3 RFC to be used in certificates: >> >> >> Any endpoint receiving any certificate which it would need to >> validate using any signature algorithm using an MD5 hash MUST abort >> the handshake with a

Re: RFR: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled [v11]

2025-04-16 Thread Artur Barashev
> MD5 algorithm is prohibited by TLSv1.3 RFC to be used in certificates: > > > Any endpoint receiving any certificate which it would need to > validate using any signature algorithm using an MD5 hash MUST abort > the handshake with a "bad_certificate" alert. > > > > The bug manifests itself wh

Integrated: 8349721: Add aarch64 intrinsics for ML-KEM

2025-04-16 Thread Ferenc Rakoczi
On Mon, 17 Feb 2025 13:53:30 GMT, Ferenc Rakoczi wrote: > By using the aarch64 vector registers the speed of the computation of the > ML-KEM algorithms (key generation, encapsulation, decapsulation) can be > approximately doubled. This pull request has now been integrated. Changeset: 465c8e65

Re: RFR: 8349721: Add aarch64 intrinsics for ML-KEM [v7]

2025-04-16 Thread Ferenc Rakoczi
On Tue, 15 Apr 2025 18:21:00 GMT, Ferenc Rakoczi wrote: >>> @ferakocz >>> >>> Hi Ferenc, >>> >>> Sorry, but I still had a few comments to add to the KyberNTTMult routine to >>> clarify exactly how the load, compute and store operations relate to the >>> original Java source. That's the only r

Re: Integrated: Merge ed30fce6df57b1cbf7a6efebabc3558550f8ec16

2025-04-16 Thread Jaikiran Pai
On Wed, 16 Apr 2025 11:20:36 GMT, Jaikiran Pai wrote: > This brings in the CPU25_04 changes into the master branch. Thank you Daniel for the review. - PR Comment: https://git.openjdk.org/jdk/pull/24683#issuecomment-2809280611

Integrated: Merge ed30fce6df57b1cbf7a6efebabc3558550f8ec16

2025-04-16 Thread Jaikiran Pai
On Wed, 16 Apr 2025 11:20:36 GMT, Jaikiran Pai wrote: > This brings in the CPU25_04 changes into the master branch. This pull request has now been integrated. Changeset: c6243fc2 Author:Jaikiran Pai URL: https://git.openjdk.org/jdk/commit/c6243fc27fafb1ff89f8610ead3acd87030caf95 Sta

Re: Integrated: Merge ed30fce6df57b1cbf7a6efebabc3558550f8ec16

2025-04-16 Thread Daniel Fuchs
On Wed, 16 Apr 2025 11:20:36 GMT, Jaikiran Pai wrote: > This brings in the CPU25_04 changes into the master branch. LGTM - Marked as reviewed by dfuchs (Reviewer). PR Review: https://git.openjdk.org/jdk/pull/24683#pullrequestreview-2772164693

Integrated: Merge ed30fce6df57b1cbf7a6efebabc3558550f8ec16

2025-04-16 Thread Jaikiran Pai
This brings in the CPU25_04 changes into the master branch. - Commit messages: The merge commit only contains trivial merges, so no merge-specific webrevs have been generated. Changes: https://git.openjdk.org/jdk/pull/24683/files Stats: 0 lines in 0 files changed: 0 ins; 0 del;

Re: RFR: 8349721: Add aarch64 intrinsics for ML-KEM [v11]

2025-04-16 Thread Andrew Dinn
On Tue, 15 Apr 2025 18:18:36 GMT, Ferenc Rakoczi wrote: >> By using the aarch64 vector registers the speed of the computation of the >> ML-KEM algorithms (key generation, encapsulation, decapsulation) can be >> approximately doubled. > > Ferenc Rakoczi has updated the pull request incrementally