On Fri, 11 Sep 2026 11:18:53 GMT, Andreas Chmielewski
<[email protected]> wrote:
>> src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
>> line 1035:
>>
>>> 1033: "sun.security.pkcs11.P11TlsMasterSecretGenerator",
>>> 1034: m(CKM_TLS12_MASTER_KEY_DERIVE,
>>> CKM_TLS12_MASTER_KEY_DERIVE_DH));
>>> 1035: d(KG, "SunTlsExtendedMasterSecret",
>>
>> Change this to `SunTls12ExtendedMasterSecret`?
>
> makes sense! Thx
There might be some issues I will have to think about .... I have copied this
piece of code from SSLConfiguration.java
// Is the extended_master_secret extension supported?
static {
boolean supportExtendedMasterSecret = Utilities.getBooleanProperty(
"jdk.tls.useExtendedMasterSecret", true);
if (supportExtendedMasterSecret) {
try {
KeyGenerator.getInstance("SunTlsExtendedMasterSecret");
} catch (NoSuchAlgorithmException nae) {
supportExtendedMasterSecret = false;
}
}
useExtendedMasterSecret = supportExtendedMasterSecret;
}
If SunPKCS11 is the only available provider, this check will fail. I have not
yet found a better solution, but my first thought was to introduce an alias:
d(KG, "SunTls12ExtendedMasterSecret",
"sun.security.pkcs11.P11TlsExtendedMasterSecretGenerator",
List.of("SunTlsExtendedMasterSecret"),
m(CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE,
CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE_DH));
What do you think?
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32081#discussion_r3989724664
