On Fri, 4 Sep 2026 13:29:27 GMT, Andreas Chmielewski <[email protected]>
wrote:
>> I see. Then checking the TLS version makes sense here. However, if this is
>> TLS 1.2 specific, it should be under an algorithm with the version info,
>> e.g. "SunTlsExtendedMasterSecret" vs "SunTls12ExtendedMasterSecret"? Maybe
>> it's time to update JSSE side to separate the usage into different
>> algorithms?
>
> Hi @valeriepeng,
>
> To make sure I understand your suggestion correctly, would the following
> approach address your concern?
>
> 1. For TLS 1.2, _SunJSSE_ uses `KeyGenerator.SunTls12ExtendedMasterSecret`
> instead of `KeyGenerator.SunTlsExtendedMasterSecret`.
> 2. For SSL 3.0, TLS 1.0, and TLS 1.1, _SunJSSE_ continues to use
> `KeyGenerator.SunTlsExtendedMasterSecret`.
> 3. _SunJCE_ adds `SunTls12ExtendedMasterSecret` as another alias of
> `KeyGenerator.SunTlsMasterSecret` (the current aliases are
> `SunTls12MasterSecret` and `SunTlsExtendedMasterSecret`).
> 4. _SunPKCS11_ only implements `SunTls12ExtendedMasterSecret` (this is
> already part of the current patch).
>
> The corresponding SunJCE change would look like:
>
>
> diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
> b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
> index 4b38bd55809..c9e7191df33 100644
> --- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
> +++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
> @@ -792,7 +792,7 @@ void putEntries() {
>
> ps("KeyGenerator", "SunTlsMasterSecret",
> "com.sun.crypto.provider.TlsMasterSecretGenerator",
> - List.of("SunTls12MasterSecret",
> "SunTlsExtendedMasterSecret"),
> + List.of("SunTls12MasterSecret",
> "SunTlsExtendedMasterSecret", "SunTls12ExtendedMasterSecret"),
> null);
>
> ps("KeyGenerator", "SunTlsKeyMaterial",
>
>
> Is this along the lines of what you had in mind?
Yes, that is right. What do you think?
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32081#discussion_r3965397884
