-
Notifications
You must be signed in to change notification settings - Fork 382
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Check the allowed crypto key size and disable MSE if insufficient #24
Comments
Just as an FYI, the upcoming JDK 8u152 will bring a programmatic way to enable unlimited key strength, without the user having to copy policy files around. The API is backward compatible, so it might make sense to do this right away. The incantation is: java.security.Security.setProperty("crypto.policy", "unlimited"); P.S.: I haven't used your library yet, but it looks really good! :) |
This is very timely and useful info, thank you for sharing! However, I'm struggling to understand from the text, whether this new property will be undefined or set to 'limited' by default in 8u125 (and later)? Common sense tells me that it should be the latter, otherwise this property would be useless in earlier versions. Is my assumption correct? |
First off, I'm not an OpenJDK developer.
Reading that, my understanding is the following:
So to find out what the current cryptographic level is, it seems like you would still need to do a check for the supported key length like in your first post. Edit: For the CLI it does seem like a good default though. Much less hassle! :) |
Code snippet here: https://gist.github.com/jehrhardt/5167854
Currently Bt just won't connect to peers if JCE unlimited strength is not installed. It would be better to automatically disable MSE negotiation and fallback to standard BitTorrent handshake (and throw an exception in CLI client if
-e
flag is provided, i.e. encryption is required).The text was updated successfully, but these errors were encountered: