Re: RFR: 8347938: Switch to latest ML-KEM private key encoding [v2]

2025-05-01 Thread Mark Powers
On Thu, 1 May 2025 11:55:20 GMT, Weijun Wang wrote: >> src/java.base/share/classes/sun/security/util/KeyUtil.java line 506: >> >>> 504: if (seed == null) return null; >>> 505: skOctets = new byte[seed.length + 2]; >>> 506: skOctets[0] = (byte)0x80;

Re: RFR: 8347938: Switch to latest ML-KEM private key encoding

2025-04-30 Thread Mark Powers
On Wed, 30 Apr 2025 15:43:31 GMT, Weijun Wang wrote: > The private key encoding formats of ML-KEM and ML-DSA are updated to match > the latest IETF drafts at: > https://datatracker.ietf.org/doc/html/draft-ietf-lamps-dilithium-certificates-08 > and > https://datatracker.ietf.org/doc/html/draft

Re: RFR: 8347938: Switch to latest ML-KEM private key encoding

2025-04-30 Thread Mark Powers
On Wed, 30 Apr 2025 15:43:31 GMT, Weijun Wang wrote: > The private key encoding formats of ML-KEM and ML-DSA are updated to match > the latest IETF drafts at: > https://datatracker.ietf.org/doc/html/draft-ietf-lamps-dilithium-certificates-08 > and > https://datatracker.ietf.org/doc/html/draft

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v3]

2025-04-29 Thread Mark Powers
On Tue, 29 Apr 2025 18:16:47 GMT, Sean Mullan wrote: >> done > > This is a side issue, but it looks like this API can also throw > `IndexOutOfBoundsException` if an offset is input which causes > `System.arraycopy` (on line 112) to access the iv out of range. Please check > and file a separate

Integrated: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative

2025-04-29 Thread Mark Powers
On Thu, 24 Apr 2025 17:22:22 GMT, Mark Powers wrote: > [JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) This pull request has now been integrated. Changeset: c2485d5f Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/c2485d5f7dd00eaed34a5d309276114eb4c78cb0 St

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v5]

2025-04-29 Thread Mark Powers
> [JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: third comment from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/24854/files - new: ht

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v4]

2025-04-29 Thread Mark Powers
On Tue, 29 Apr 2025 16:52:09 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> second comment from Sean > > test/jdk/java/security/spec/RC2ParameterSpec/InvalidA

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v3]

2025-04-29 Thread Mark Powers
On Tue, 29 Apr 2025 13:08:36 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> comment from Sean > > src/java.base/share/classes/javax/crypto/spec/RC2Paramete

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v4]

2025-04-29 Thread Mark Powers
> [JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: second comment from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/24854/files - new: ht

Re: RFR: 8350498: Remove two Camerfirma root CA certificates

2025-04-28 Thread Mark Powers
On Tue, 22 Apr 2025 20:27:04 GMT, Rajan Halade wrote: > The change is to remove two Camerfirma root certificates which are terminated > and no longer in use. These two roots are removed from `cacerts` truststore. > Distrust of these roots is also removed as these roots will no longer be > trus

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v2]

2025-04-28 Thread Mark Powers
On Mon, 28 Apr 2025 20:13:47 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> need test > > test/jdk/java/security/spec/InvalidArrayIndex.java line 1: > >> 1:

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v3]

2025-04-28 Thread Mark Powers
> [JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: comment from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/24854/files - new: ht

Re: RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative [v2]

2025-04-25 Thread Mark Powers
> [JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: need test - Changes: - all: https://git.openjdk.org/jdk/pull/24854/files - new: https://git.openjdk.org/

RFR: 8351113: RC2ParameterSpec throws IllegalArgumentException when offset is negative

2025-04-24 Thread Mark Powers
[JDK-8351113](https://bugs.openjdk.org/browse/JDK-8351113) - Commit messages: - first iteration Changes: https://git.openjdk.org/jdk/pull/24854/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=24854&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8351113 Stats: 6 lin

Re: RFR: 8348732: SunJCE and SunPKCS11 have different PBE key encodings [v5]

2025-04-17 Thread Mark Powers
On Tue, 15 Apr 2025 23:01:56 GMT, Valerie Peng wrote: >> As part of [https://bugs.openjdk.org/browse/JDK-8301553](JDK-8301553), >> SunPKCS11 provider added support for PBE SecretKeyFactories for >> `HmacPBESHAxxx` and `PBEWithHmacSHAxxxAndAES_yyy`. These impls produce keys >> whose encoding co

Re: RFR: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled [v11]

2025-04-16 Thread Mark Powers
On Wed, 16 Apr 2025 14:57:20 GMT, Artur Barashev wrote: >> MD5 algorithm is prohibited by TLSv1.3 RFC to be used in certificates: >> >> >> Any endpoint receiving any certificate which it would need to >> validate using any signature algorithm using an MD5 hash MUST abort >> the handshake with a

Re: RFR: 8349534: Refactor jdk/sun/security/krb5/runNameEquals.sh to java test [v4]

2025-04-09 Thread Mark Powers
On Tue, 11 Feb 2025 18:46:29 GMT, Mikhail Yankelevich wrote: >> Refactored the runNameEquals.sh to java test > > Mikhail Yankelevich has updated the pull request incrementally with one > additional commit since the last revision: > > minor Looks good to me. IntelliJ couldn't find problems e

Re: RFR: 8353478: Update crypto microbenchmarks to cover ML-DSA, ML-KEM, and HSS algorithms [v2]

2025-04-08 Thread Mark Powers
On Sun, 6 Apr 2025 00:32:17 GMT, Sergey Kuksenko wrote: >> Update crypto microbenchmarks to cover ML-DSA, ML-KEM, and HSS algorithms. > > Sergey Kuksenko has updated the pull request incrementally with one > additional commit since the last revision: > > Update test/micro/org/openjdk/bench/ja

Re: RFR: 8351034: Add AVX-512 intrinsics for ML-DSA [v2]

2025-03-04 Thread Mark Powers
On Mon, 3 Mar 2025 19:00:59 GMT, Ferenc Rakoczi wrote: >> By using the AVX-512 vector registers the speed of the computation of the >> ML-DSA algorithms (key generation, document signing, signature verification) >> can be approximately doubled. > > Ferenc Rakoczi has updated the pull request in

Re: RFR: 8349721: Add aarch64 intrinsics for ML-KEM

2025-02-25 Thread Mark Powers
On Mon, 17 Feb 2025 13:53:30 GMT, Ferenc Rakoczi wrote: > By using the aarch64 vector registers the speed of the computation of the > ML-KEM algorithms (key generation, encapsulation, decapsulation) can be > approximately doubled. ML-KEM benchmark results of this PR: MLKEM.decapsulate 512 1

Integrated: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes

2025-02-25 Thread Mark Powers
On Sat, 18 Jan 2025 00:14:58 GMT, Mark Powers wrote: > [JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) This pull request has now been integrated. Changeset: 50239716 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/50239716403732fe8af73b4b6f006b6a4b7b22db St

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes [v4]

2025-02-20 Thread Mark Powers
> [JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: nit - Changes: - all: https://git.openjdk.org/jdk/pull/23188/files - new: https://git.openjdk.org/jdk/p

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes [v3]

2025-02-20 Thread Mark Powers
On Wed, 12 Feb 2025 18:41:45 GMT, Valerie Peng wrote: >> Maybe we should just state that ArrayIndexOutOfBoundsException is thrown if >> `offset` or `len` is negative? The current wording for AIOOBE seems to >> suggest that it covers the case when `offset` or `len` is too large. But >> that is

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes [v3]

2025-02-20 Thread Mark Powers
On Wed, 12 Feb 2025 21:08:50 GMT, Valerie Peng wrote: >> Mark Powers has updated the pull request with a new target base due to a >> merge or a rebase. The pull request now contains three commits: >> >> - Merge master >> - review comments from Valerie and Sean

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes [v3]

2025-02-19 Thread Mark Powers
> [JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) Mark Powers has updated the pull request with a new target base due to a merge or a rebase. The pull request now contains three commits: - Merge master - review comments from Valerie and Sean - first iterat

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes [v2]

2025-02-19 Thread Mark Powers
> [JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: review comments from Valerie and Sean - Changes: - all: https://git.openjdk.org/jdk/pull/23188/files -

Re: RFR: 8348561: Add aarch64 intrinsics for ML-DSA [v5]

2025-02-10 Thread Mark Powers
On Thu, 6 Feb 2025 18:47:54 GMT, Ferenc Rakoczi wrote: >> By using the aarch64 vector registers the speed of the computation of the >> ML-DSA algorithms (key generation, document signing, signature verification) >> can be approximately doubled. > > Ferenc Rakoczi has updated the pull request in

[jdk24] Integrated: 8349084: Update vectors used in several PQC benchmarks

2025-02-05 Thread Mark Powers
On Wed, 5 Feb 2025 20:22:47 GMT, Mark Powers wrote: > Hi all, > > This pull request contains a backport of commit 2f2f7cf0 from the openjdk/jdk > repository. > > The commit being backported was authored by Mark Powers on 5 Feb 2025 and was > reviewed by Weijun Wang. &g

[jdk24] RFR: JDK-8349084 : Update vectors used in several PQC benchmarks

2025-02-05 Thread Mark Powers
[JDK-8349084](https://bugs.openjdk.org/browse/JDK-8349084) - Commit messages: - Backport 2f2f7cf082f11d6dfc4f8a5401ec1c5629dc Changes: https://git.openjdk.org/jdk/pull/23473/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=23473&range=00 Issue: https://bugs.openjdk.org

Integrated: 8349084: Update vectors used in several PQC benchmarks

2025-02-05 Thread Mark Powers
On Tue, 4 Feb 2025 23:39:48 GMT, Mark Powers wrote: > [JDK-8349084](https://bugs.openjdk.org/browse/JDK-8349084) This pull request has now been integrated. Changeset: 2f2f7cf0 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/2f2f7cf082f11d6dfc4f8a5401ec1c5629dc St

Re: RFR: 8349084: Update vectors used in several PQC benchmarks [v2]

2025-02-05 Thread Mark Powers
> [JDK-8349084](https://bugs.openjdk.org/browse/JDK-8349084) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: update LMS test vectors - Changes: - all: https://git.openjdk.org/jdk/pull/23452/files - new: ht

RFR: 8349084: Update vectors used in several PQC benchmarks

2025-02-04 Thread Mark Powers
[JDK-8349084](https://bugs.openjdk.org/browse/JDK-8349084) - Commit messages: - first iteration Changes: https://git.openjdk.org/jdk/pull/23452/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=23452&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8349084 Stats: 2310

Integrated: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs

2025-01-24 Thread Mark Powers
On Wed, 8 Jan 2025 23:27:34 GMT, Mark Powers wrote: > [JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) This pull request has now been integrated. Changeset: 907350e9 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/907350e9e8e9b66365e9eaa3ae89ddc55cf9731f St

Re: RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs [v3]

2025-01-24 Thread Mark Powers
On Thu, 23 Jan 2025 22:17:14 GMT, Sean Mullan wrote: >> I think you added the fields for the root certificates, and not these >> certificates. Also, these are not root certificates, so I would remove "Root >> Certificate". >> >> You can use `keytool -printcert -file ...` and just include the f

Re: RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs [v3]

2025-01-24 Thread Mark Powers
> [JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: no root certificate - Changes: - all: https://git.openjdk.org/jdk/pull/22985/files - new: ht

Re: RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs [v2]

2025-01-23 Thread Mark Powers
On Thu, 23 Jan 2025 17:56:06 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> comments from Sean > > test/jdk/sun/security/ssl/X509TrustManagerImpl/distrust/Camerf

Re: RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs [v2]

2025-01-23 Thread Mark Powers
> [JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) Mark Powers has updated the pull request incrementally with one additional commit since the last revision: comments from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/22985/files - new: ht

RFR: 8346587: TLS server certificates anchored by Camerfirma Root CAs

2025-01-23 Thread Mark Powers
[JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) - Commit messages: - first iteration Changes: https://git.openjdk.org/jdk/pull/22985/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=22985&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8346587 Stats: 342 l

Re: RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes

2025-01-21 Thread Mark Powers
On Sat, 18 Jan 2025 00:14:58 GMT, Mark Powers wrote: > [JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) So a CSR is needed even if the only change is to sync javadoc with the code? - PR Comment: https://git.openjdk.org/jdk/pull/23188#issuecomment-2605202927

RFR: 8267068: Incomplete @throws javadoc for various javax.crypto.spec classes

2025-01-17 Thread Mark Powers
[JDK-8267068](https://bugs.openjdk.org/browse/JDK-8267068) - Commit messages: - first iteration Changes: https://git.openjdk.org/jdk/pull/23188/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=23188&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8267068 Stats: 15 li

Re: RFR: 8347596: Update HSS/LMS public key encoding [v2]

2025-01-13 Thread Mark Powers
On Mon, 13 Jan 2025 23:42:27 GMT, Weijun Wang wrote: >> src/java.base/share/classes/sun/security/provider/HSS.java line 788: >> >>> 786: if (keyArray[0] == DerValue.tag_OctetString >>> 787: && keyArray[1] == keyArray.length - 2) { >>> 788: // pre-8

Re: RFR: 8347596: Update HSS/LMS public key encoding [v2]

2025-01-13 Thread Mark Powers
On Mon, 13 Jan 2025 18:26:17 GMT, Weijun Wang wrote: >> Update the encoding of HSS/LMS public key to be consistent with >> https://www.rfc-editor.org/rfc/rfc9708.html#name-changes-since-rfc-8708 and >> https://datatracker.ietf.org/doc/html/draft-ietf-lamps-x509-shbs-13#name-hss-public-keys. > >

Re: RFR: 8342062: Reformat keytool and jarsigner output for keys with a named parameter set [v3]

2025-01-08 Thread Mark Powers
On Fri, 13 Dec 2024 15:10:15 GMT, Weijun Wang wrote: >> Traditionally, an asymmetric key has a key size. The size is displayed by >> `keytool` and `jarsigner`, both in informational output and weak-key >> warnings. However, for the recently added ML-DSA algorithm, key size is not >> defined. >

Re: RFR: 8344137: Update XML Security for Java to 3.0.5

2024-12-05 Thread Mark Powers
On Thu, 5 Dec 2024 20:54:58 GMT, Weijun Wang wrote: > Update XML Signature to Apache Santuario 3.0.5. The only thing I noticed were old Oracle copyright dates in some files with "dom" or "DOM" in their path names. Many contained a single 2005 but at least one had 2005 plus another date that wa

Re: RFR: 8344137: Update XML Security for Java to 3.0.5

2024-12-05 Thread Mark Powers
On Thu, 5 Dec 2024 20:54:58 GMT, Weijun Wang wrote: > Update XML Signature to Apache Santuario 3.0.5. src/java.xml.crypto/share/legal/santuario.md line 226: > 224: > 225: This product contains software that is > 226: copyright (c) 2021, 2023, Oracle and/or its affiliates. Why not 2024? -

Re: RFR: 8344144: AES/CBC slow at big payloads [v2]

2024-11-14 Thread Mark Powers
On Thu, 14 Nov 2024 00:44:35 GMT, Volodymyr Paprotski wrote: >> Measuring throughput with JMH parameters `-f 1 -i 2 -wi 3 -r 20 -w 30 -p >> algorithm=AES/CBC/NoPadding -p dataSize=3000 -p provider=SunJCE -p >> keyLength=128 org.openjdk.bench.javax.crypto.full.AESBench` >> >> Before: >>

Re: RFR: JDK-8300416 java.security.MessageDigestSpi clone can result in thread-unsafe clones [v5]

2024-11-12 Thread Mark Powers
On Tue, 7 Feb 2023 15:58:31 GMT, Mark Powers wrote: >> https://bugs.openjdk.org/browse/JDK-8300416 > > Mark Powers has updated the pull request incrementally with one additional > commit since the last revision: > > Sean's test comment I would backport. It's

Re: RFR: 8342442: Static ACVP sample tests [v12]

2024-11-08 Thread Mark Powers
On Fri, 8 Nov 2024 18:00:42 GMT, Weijun Wang wrote: >> Here we have a launcher and several algorithm-specific tests. Users can >> populate "internalProjection.json" files generated by NIST's ACVP Server >> into the `data` directory and test them with the launcher. >> >> Currently, only SHA2, S

Re: RFR: 8298387: Implementing ML-DSA signature algorithm [v23]

2024-11-08 Thread Mark Powers
On Thu, 7 Nov 2024 16:14:45 GMT, Mark Powers wrote: >> Ben Perez has updated the pull request incrementally with two additional >> commits since the last revision: >> >> - checking already implemented >> - no need to break into sections > > test/m

Re: RFR: 8298387: Implementing ML-DSA signature algorithm [v23]

2024-11-07 Thread Mark Powers
On Thu, 7 Nov 2024 00:37:02 GMT, Ben Perez wrote: >> Java implementation of ML-DSA, the FIPS 204 post-quantum signature scheme >> https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf. Depends on >> https://github.com/openjdk/jdk/pull/21167 > > Ben Perez has updated the pull request incremen

Re: RFR: 8298387: Implementing ML-DSA signature algorithm [v23]

2024-11-07 Thread Mark Powers
On Thu, 7 Nov 2024 00:37:02 GMT, Ben Perez wrote: >> Java implementation of ML-DSA, the FIPS 204 post-quantum signature scheme >> https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf. Depends on >> https://github.com/openjdk/jdk/pull/21167 > > Ben Perez has updated the pull request incremen

Re: RFR: 8298390: Implementing ML-KEM key encapsulation mechanism [v5]

2024-11-01 Thread Mark Powers
On Tue, 15 Oct 2024 22:17:26 GMT, Ben Perez wrote: >> Java implementation of ML-KEM, the [FIPS >> 203](https://csrc.nist.gov/pubs/fips/203/final) post-quantum KEM scheme. >> Depends on https://github.com/openjdk/jdk/pull/21167 > > Ben Perez has updated the pull request incrementally with one ad

Re: RFR: 8298387: Implementing ML-DSA signature algorithm [v8]

2024-10-31 Thread Mark Powers
On Mon, 21 Oct 2024 20:42:14 GMT, Weijun Wang wrote: >> src/java.base/share/classes/sun/security/provider/ML_DSA.java line 1: >> >>> 1: /* >> >> Does this class need to be public? Many methods are also public - do they >> need to be? > > No need, but Mark's test might be using it. Benchmarks

Re: RFR: 8342442: Static ACVP sample tests [v3]

2024-10-31 Thread Mark Powers
On Thu, 31 Oct 2024 17:21:06 GMT, Weijun Wang wrote: >> Here we have a launcher and several algorithm-specific tests. Users can >> populate "internalProjection.json" files generated by NIST's ACVP Server >> into the `data` directory and test them with the launcher. >> >> Currently, only SHA2,

Integrated: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer

2024-10-24 Thread Mark Powers
On Fri, 9 Aug 2024 17:22:56 GMT, Mark Powers wrote: > https://bugs.openjdk.org/browse/JDK-8336665 This pull request has now been integrated. Changeset: ca1700b8 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/ca1700b8bf3b7b34616c469837748ac4c3607dfc Stats: 93 li

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v7]

2024-10-22 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: more precise comment - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: https://git.openjdk.org/

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v6]

2024-10-22 Thread Mark Powers
On Tue, 22 Oct 2024 14:27:19 GMT, Sean Mullan wrote: >> The CRL is being constructed from a fuzzed data input stream. All I know is >> that the name in the CertificateIssuerExtension looks like an x509.OIDName >> in the first test, and in the second test it looks like an x509.X400Address. >> >

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v6]

2024-10-22 Thread Mark Powers
On Mon, 21 Oct 2024 17:28:42 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> more precise exception message > > test/jdk/sun/security/x509/X509CRLImpl/Unexpe

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v5]

2024-10-21 Thread Mark Powers
On Fri, 18 Oct 2024 13:40:38 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> allow more than one name > > src/java.base/share/classes/sun/security/x509/X509CR

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v6]

2024-10-21 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: more precise exception message - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: ht

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v4]

2024-10-21 Thread Mark Powers
On Fri, 18 Oct 2024 13:50:13 GMT, Sean Mullan wrote: >> Does the test need to be modified to test for more than one name? I could go >> either way. > > Are you able to easily create test CRLs with more than one entry? If not, I > think the existing test is ok. I know how to create a Certificat

Re: RFR: 8342002: sun/security/tools/keytool/GenKeyPairSigner.java failed due to missing certificate output

2024-10-14 Thread Mark Powers
On Mon, 14 Oct 2024 13:53:10 GMT, Weijun Wang wrote: > Previous code change for > [JDK-8340327](https://bugs.openjdk.org/browse/JDK-8340327) changed the > display names for all keys with a `NamedParameterSpec` to be the parameter > set name. This test is not updated. > > I understand the curr

Re: RFR: 8341792: Fix ExceptionOccurred in java.security.jgss

2024-10-10 Thread Mark Powers
On Wed, 9 Oct 2024 16:22:13 GMT, Weijun Wang wrote: > Switch to `ExceptionCheck`. > > This is a part of an umbrella bug [JDK-8341542 JNI uses of > ExceptionOccurred() treated as if function returns a > bool](https://bugs.openjdk.org/browse/JDK-8341542). Looks good to me. - PR Co

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v4]

2024-10-08 Thread Mark Powers
On Tue, 8 Oct 2024 15:28:58 GMT, Mark Powers wrote: >> src/java.base/share/classes/sun/security/x509/X509CRLImpl.java line 292: >> >>> 290: throw new CRLException("Parsing error: " >>> 291:

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v4]

2024-10-08 Thread Mark Powers
On Tue, 24 Sep 2024 12:33:54 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> another comment from Sean > > src/java.base/share/classes/sun/security/x509/X509CR

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v5]

2024-10-08 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: allow more than one name - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: https://git.openjdk.org/

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v3]

2024-09-11 Thread Mark Powers
On Wed, 11 Sep 2024 13:26:27 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> comment from Sean > > src/java.base/share/classes/sun/security/x509/X509CR

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v4]

2024-09-11 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: another comment from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: https://git.openjdk.

Integrated: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs

2024-09-03 Thread Mark Powers
On Tue, 27 Aug 2024 17:18:29 GMT, Mark Powers wrote: > Please review this change to distrust TLS server certificates issued after > October 31, 2024 and anchored by Entrust Root CAs. This change is in line > with similar plans recently announced by Google and Mozilla. T

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v4]

2024-09-03 Thread Mark Powers
On Tue, 3 Sep 2024 17:38:30 GMT, Rajan Halade wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> beware moving lines around > > test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Dis

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v4]

2024-09-03 Thread Mark Powers
On Tue, 3 Sep 2024 17:41:24 GMT, Rajan Halade wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> beware moving lines around > > test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Dis

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v4]

2024-09-02 Thread Mark Powers
On Mon, 2 Sep 2024 21:47:25 GMT, Mark Powers wrote: >> Please review this change to distrust TLS server certificates issued after >> October 31, 2024 and anchored by Entrust Root CAs. This change is in line >> with similar plans recently announced by Google and M

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v4]

2024-09-02 Thread Mark Powers
to be valid until they > expire. This restriction should have minimal compatibility impact since > Entrust has announced they will be using a partner (SSL.com) for all TLS > server certificates issued after Oct 31, 2024. > > See the CSR for more details: https://bugs.openjdk.org/brow

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v3]

2024-08-30 Thread Mark Powers
to be valid until they > expire. This restriction should have minimal compatibility impact since > Entrust has announced they will be using a partner (SSL.com) for all TLS > server certificates issued after Oct 31, 2024. > > See the CSR for more details: https://bugs.openjdk.org/brow

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v2]

2024-08-30 Thread Mark Powers
On Wed, 28 Aug 2024 13:02:30 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> remove unused files > > src/java.base/share/classes/sun/security/validator/EntrustTLS

Re: RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs [v2]

2024-08-30 Thread Mark Powers
to be valid until they > expire. This restriction should have minimal compatibility impact since > Entrust has announced they will be using a partner (SSL.com) for all TLS > server certificates issued after Oct 31, 2024. > > See the CSR for more details: https://bugs.openjdk.org/brow

RFR: 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs

2024-08-30 Thread Mark Powers
Please review this change to distrust TLS server certificates issued after October 31, 2024 and anchored by Entrust Root CAs. This change is in line with similar plans recently announced by Google and Mozilla. TLS server certificates issued before this date will continue to be valid until they e

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v2]

2024-08-15 Thread Mark Powers
On Mon, 12 Aug 2024 19:20:17 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> copyright and unnecessary initialization > > src/java.base/share/classes/sun/security/

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v3]

2024-08-13 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: comment from Sean - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: https://git.openjdk.org/jdk/p

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer [v2]

2024-08-12 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-8336665 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: copyright and unnecessary initialization - Changes: - all: https://git.openjdk.org/jdk/pull/20528/files - new: ht

Re: RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer

2024-08-09 Thread Mark Powers
On Fri, 9 Aug 2024 17:22:56 GMT, Mark Powers wrote: > https://bugs.openjdk.org/browse/JDK-8336665 Need to update copyright on X509CRLImpl.java. - PR Comment: https://git.openjdk.org/jdk/pull/20528#issuecomment-2278477735

RFR: 8336665: CCE in X509CRLImpl$TBSCertList.getCertIssuer

2024-08-09 Thread Mark Powers
https://bugs.openjdk.org/browse/JDK-8336665 - Commit messages: - first iteration Changes: https://git.openjdk.org/jdk/pull/20528/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=20528&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8336665 Stats: 88 lines in 2 files

Integrated: 4966250: SSLSessionContext.setSessionTimeout() documentation could be updated

2024-08-01 Thread Mark Powers
On Wed, 29 May 2024 15:45:12 GMT, Mark Powers wrote: > https://bugs.openjdk.org/browse/JDK-4966250 This pull request has now been integrated. Changeset: f1fa64b6 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/f1fa64b6b67f2eef916b8d92eb522ccb19035e12 Stats: 25 li

Re: RFR: 4966250: SSLSessionContext.setSessionTimeout() documentation could be updated [v3]

2024-07-11 Thread Mark Powers
On Wed, 29 May 2024 19:20:27 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> Joe Darcy's comment > > src/java.base/share/classes/javax/net/ssl/SSLSessionContext.

Integrated: 8333364: Minor cleanup could be done in com.sun.crypto.provider

2024-07-09 Thread Mark Powers
On Tue, 4 Jun 2024 02:32:31 GMT, Mark Powers wrote: > https://bugs.openjdk.org/browse/JDK-864 This pull request has now been integrated. Changeset: 14721244 Author: Mark Powers URL: https://git.openjdk.org/jdk/commit/1472124489c841642996ae984e21c533ffec8091 Stats: 419 li

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v5]

2024-07-08 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-864 Mark Powers has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains seven additional commits since the l

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-07-08 Thread Mark Powers
On Tue, 2 Jul 2024 17:23:18 GMT, Kevin Driver wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> move variables to above try block > > src/java.base/share/classes/com/sun/crypto/pr

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-07-05 Thread Mark Powers
On Mon, 24 Jun 2024 18:26:34 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> move variables to above try block > > src/java.base/share/classes/com/sun/crypto/pro

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-07-02 Thread Mark Powers
On Mon, 24 Jun 2024 18:15:21 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> move variables to above try block > > src/java.base/share/c

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-07-01 Thread Mark Powers
On Mon, 24 Jun 2024 18:12:47 GMT, Sean Mullan wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> move variables to above try block > > src/java.base/share/classes/com/sun/crypto/pro

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-06-20 Thread Mark Powers
On Fri, 14 Jun 2024 13:11:06 GMT, Mark Powers wrote: >> https://bugs.openjdk.org/browse/JDK-864 > > Mark Powers has updated the pull request incrementally with one additional > commit since the last revision: > > move variables to above try block Thanks for the re

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v4]

2024-06-14 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-864 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: move variables to above try block - Changes: - all: https://git.openjdk.org/jdk/pull/19535/files - new: ht

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v3]

2024-06-13 Thread Mark Powers
On Thu, 13 Jun 2024 21:23:27 GMT, Valerie Peng wrote: >> No. The two variables wouldn't be in scope for the `finally` block on line >> 276. > > How about right above the block where they are assigned? The reason that I > suggested this is that it's easier to see why no default value needed when

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v3]

2024-06-13 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-864 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: join two lines - Changes: - all: https://git.openjdk.org/jdk/pull/19535/files - new: https://git.openjdk.org/jdk/p

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v3]

2024-06-13 Thread Mark Powers
On Wed, 12 Jun 2024 04:15:44 GMT, Valerie Peng wrote: >> Mark Powers has updated the pull request incrementally with one additional >> commit since the last revision: >> >> join two lines > > src/java.base/share/classes/com/sun/crypto/provider/CipherCore.java li

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider

2024-06-13 Thread Mark Powers
On Thu, 6 Jun 2024 20:10:10 GMT, Valerie Peng wrote: >> https://bugs.openjdk.org/browse/JDK-864 > > src/java.base/share/classes/com/sun/crypto/provider/AESKeyWrap.java line 121: > >> 119: @Override >> 120: int encrypt(byte[] pt, int ptOfs, int ptLen, byte[] ct, int ctOfs) { >> 121:

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider [v2]

2024-06-13 Thread Mark Powers
> https://bugs.openjdk.org/browse/JDK-864 Mark Powers has updated the pull request incrementally with one additional commit since the last revision: comments from Valerie - Changes: - all: https://git.openjdk.org/jdk/pull/19535/files - new: https://git.openjdk.org/

Re: RFR: 8326705: Test CertMsgCheck.java fails to find alert certificate_required

2024-06-06 Thread Mark Powers
On Wed, 5 Jun 2024 23:48:56 GMT, Anthony Scarpino wrote: >> test/jdk/javax/net/ssl/templates/TLSBase.java line 101: >> >>> 99: if (!empty) { >>> 100: fis = new FileInputStream(System.getProperty("test.src", >>> "./") + >>> 101: "/" + pathToStores + "/" + keyS

Re: RFR: 8326705: Test CertMsgCheck.java fails to find alert certificate_required

2024-06-05 Thread Mark Powers
On Wed, 5 Jun 2024 02:57:41 GMT, Anthony Scarpino wrote: > Hi, > > I need a review for this simple change to fix a threading problem with the > test. The server thread was not completing before the check occurred on the > main thread. The failure showed up in windows and macos, but not linux.

Re: RFR: 8333364: Minor cleanup could be done in com.sun.crypto.provider

2024-06-03 Thread Mark Powers
On Tue, 4 Jun 2024 02:32:31 GMT, Mark Powers wrote: > https://bugs.openjdk.org/browse/JDK-864 This is the last cleanup bug. After integration, the umbrella bug can be closed. - PR Comment: https://git.openjdk.org/jdk/pull/19535#issuecomment-2146459913

  1   2   3   4   >