On Wed, 9 Sep 2026 06:43:27 GMT, Valerie Peng <[email protected]> wrote:
>> Hi @valeriepeng,
>>
>> To make sure I understand your suggestion correctly, would the following
>> approach address your concern?
>>
>> 1. For TLS 1.2, _SunJSSE_ uses `KeyGenerator.SunTls12ExtendedMasterSecret`
>> instead of `KeyGenerator.SunTlsExtendedMasterSecret`.
>> 2. For SSL 3.0, TLS 1.0, and TLS 1.1, _SunJSSE_ continues to use
>> `KeyGenerator.SunTlsExtendedMasterSecret`.
>> 3. _SunJCE_ adds `SunTls12ExtendedMasterSecret` as another alias of
>> `KeyGenerator.SunTlsMasterSecret` (the current aliases are
>> `SunTls12MasterSecret` and `SunTlsExtendedMasterSecret`).
>> 4. _SunPKCS11_ only implements `SunTls12ExtendedMasterSecret` (this is
>> already part of the current patch).
>>
>> The corresponding SunJCE change would look like:
>>
>>
>> diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
>> b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
>> index 4b38bd55809..c9e7191df33 100644
>> --- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
>> +++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
>> @@ -792,7 +792,7 @@ void putEntries() {
>>
>> ps("KeyGenerator", "SunTlsMasterSecret",
>> "com.sun.crypto.provider.TlsMasterSecretGenerator",
>> - List.of("SunTls12MasterSecret",
>> "SunTlsExtendedMasterSecret"),
>> + List.of("SunTls12MasterSecret",
>> "SunTlsExtendedMasterSecret", "SunTls12ExtendedMasterSecret"),
>> null);
>>
>> ps("KeyGenerator", "SunTlsKeyMaterial",
>>
>>
>> Is this along the lines of what you had in mind?
>
> Yes, that is right. What do you think?
Yes, I think we can go with that solution.
I also considered introducing version-specific EMS algorithms for all supported
TLS versions:
- SunTls10ExtendedMasterSecret
- SunTls11ExtendedMasterSecret
- SunTls12ExtendedMasterSecret
However, this did not sound like the correct solution. I have committed the
change above
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32081#discussion_r3977246731
