On Fri, 1 Nov 2024 18:06:30 GMT, Artur Barashev <abaras...@openjdk.org> wrote:
> The current syntax of the jdk.tls.disabledAlgorithms makes it difficult to
> disable algorithms that affect both the key exchange and authentication parts
> of a TLS cipher suite. For example, if you add "RSA" to the
> jdk.tls.disabledAlgorithms security property, it disables all cipher suites
> that use RSA, whether it is for key exchange or authentication. If you only
> want to disable cipher suites that use RSA for key exchange, the only
> workaround is to list the whole cipher suite name, so an exact match is done,
> but if there are many cipher suites that use that key exchange algorithm,
> this becomes cumbersome.
src/java.base/share/classes/sun/security/util/AbstractAlgorithmConstraints.java
line 91:
> 89: // Wild card matching
> 90: for (String p : algorithms) {
> 91: if (Pattern.compile(p.replace("*", ".*"),
> Pattern.CASE_INSENSITIVE)
What is the performance impact of this change in terms of both allocations and
duration of compiling and matching this regex on overall handshake?
My sense is that this is going to be very expensive for TLS connection overhead.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/21841#discussion_r1826736186
