openjdk7 crypto strength broken

[coyhile]

OpenJDK7 on SmartOS seems to have broken crypto support. The following code snippet should show the crypto strength allowed (at least for AES):

caadmin@rootca:/tmp$ cat KeyLengthDetector.java
import javax.crypto.Cipher;
import java.security.NoSuchAlgorithmException;

public class KeyLengthDetector {
public static void main(String[] args) {
int allowedKeyLength = 0;

try {
  allowedKeyLength = Cipher.getMaxAllowedKeyLength("AES");
} catch (NoSuchAlgorithmException e) {
  e.printStackTrace();
}

System.out.println("The allowed key length for AES is: " + allowedKeyLength);

}
}
caadmin@rootca:/tmp$

Run on a Debian box, we see the following:

caadmin@rootca:/tmp$ java -version
java version "1.7.0_51"
OpenJDK Runtime Environment (IcedTea 2.4.6) (7u51-2.4.6-1)
OpenJDK 64-Bit Server VM (build 24.51-b03, mixed mode)
caadmin@rootca:/tmp$ java KeyLengthDetector
The allowed key length for AES is: 2147483647
caadmin@rootca:/tmp$

Contrast that with a SmartOS host:

[root@sshgtw /tmp]# java KeyLengthDetector
The allowed key length for AES is: 128
[root@sshgtw /tmp]# java -version
openjdk version "1.7.0-internal"
OpenJDK Runtime Environment (build 1.7.0-internal-pkgsrc_2014_04_08_15_25-b00)
OpenJDK 64-Bit Server VM (build 23.21-b01, mixed mode)
[root@sshgtw /tmp]#

[mamash]

Not a bug and not "broken" really. When you build OpenJDK7, it still defaults to limited crypto. Traditionally the only way to build with unlimited crypto was to download the respective class files from Oracle and inject, which is why pkgsrc couldn't do this by default (due to Oracle licensing getting in the way). Based on some IRC input about a month ago, we found out that another option was introduced in OpenJDK at some time (that I couldn't be bothered to track down exactly), so we reimplemented it in pkgsrc, and backported the change to the Joyent 2014Q3 package set. Starting with openjdk7-1.7.65nb1 there, the package comes with unlimited crypto by default.