8320449: ECDHKeyAgreement should validate parameters before using them #17373

johnshajiang · 2024-01-11T13:33:54Z

ECDHKeyAgreement should validate the parameters before assigning them to the fields.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8320449: ECDHKeyAgreement should validate parameters before using them (Bug - P3)

Reviewers

Sean Mullan (@seanjmullan - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/17373/head:pull/17373
$ git checkout pull/17373

Update a local copy of the PR:
$ git checkout pull/17373
$ git pull https://git.openjdk.org/jdk.git pull/17373/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 17373

View PR using the GUI difftool:
$ git pr show -t 17373

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/17373.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2024-01-11T13:35:08Z

👋 Welcome back jjiang! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-01-11T13:37:17Z

@johnshajiang The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2024-01-11T13:41:34Z

Webrevs

seanjmullan · 2024-01-12T13:46:43Z

src/java.base/share/classes/sun/security/ec/ECDHKeyAgreement.java

+        privateKey = null;
+        privateKeyOps = null;
+        publicKey = null;


The fields should be initialized to null, so I don't think you need these lines.

KeyAgreement ka = KeyAgreement.getInstance("ECDH"); ka.init(key1); ka.init(key2);

If no those lines, when the second init throws exception, and the keys set by the first init are not cleared.
Please consider the test case testInitWithInvalidKey in ECDHKeyAgreementParamValidation.

Yes, you are right.

seanjmullan · 2024-01-12T20:51:03Z

test/jdk/sun/security/ec/ECDHKeyAgreementParamValidation.java

+ * @test
+ * @bug 8320449
+ * @summary ECDHKeyAgreement should validate parameters before assigning them to fields.
+ * @run junit ECDHKeyAgreementParamValidation


Most security regression tests don't use junit. I think it would be better to not rely on it. There is a similar asserts library for tests that you can use in test/lib/jdk/test/lib/Asserts.java.

I originally didn't depend on JUnit. But this tool can easily execute multiple test cases independently.
A single failed case doesn't make the whole test fail fast, and all cases always be executed.

Fair point, although there are ways to workaround that w/o junit.

AFAICT, this will be the first security test to depend on junit. @rhalade are you ok with this?

Just updated this test and not used JUnit.

ecki · 2024-01-13T01:07:20Z

test/jdk/sun/security/ec/ECDHKeyAgreementParamValidation.java

+
+        KeyAgreement ka = KeyAgreement.getInstance("ECDH");
+        ka.init(kpP256.getPrivate());
+        try {


Should this be assertThrows like the other ones?

I assumed this point must fail and my fix for this bug didn't concern it.
Maybe some test on KeyAgreement already does that, so I didn't add a check point on it.

Anyway, just added this assertion.

seanjmullan · 2024-01-16T13:40:20Z

test/jdk/sun/security/ec/ECDHKeyAgreementParamValidation.java

+        Asserts.assertThrows(
+                IllegalStateException.class,
+                ()->ka.doPhase(kp.getPublic(), true));
+    }


How about also calling generateSecret and checking for IllegalStateException?

seanjmullan · 2024-01-16T13:41:06Z

test/jdk/sun/security/ec/ECDHKeyAgreementParamValidation.java

+                InvalidKeyException.class,
+                () -> ka.doPhase(kpP384.getPublic(), true));
+
+        // Should not generate share key with SECP256R1 private key and SECP384R1 public key


Typo: s/share/shared/

openjdk · 2024-01-16T18:46:43Z

@johnshajiang This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8320449: ECDHKeyAgreement should validate parameters before using them

Reviewed-by: mullan

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 80 new commits pushed to the master branch:

b533272: 8299627: Fix/improve handling of "missing" element-list file
1007618: 8323731: Unproblemlist gc/stress/TestStressG1Humongous.java
790871e: 8323800: Serial: Fix include guard macro in generation.hpp
0216f5d: 8323730: Tweak TestZAllocationStallEvent.java to allocate smaller objects
21f6473: 8322675: JFR: Fail-fast mode when constants cannot be resolved
e2d6023: 8323631: JfrTypeSet::write_klass can enqueue a CLD klass that is unloading
2fd775f: 8323651: compiler/c2/irTests/TestPrunedExHandler.java fails with -XX:+DeoptimizeALot
ee4d9aa: 8323659: LinkedTransferQueue add and put methods call overridable offer
5045839: 8323635: Test gc/g1/TestHumongousAllocConcurrentStart.java fails with -XX:TieredStopAtLevel=3
44a9392: 8323780: Serial: Remove unused _full_collections_completed
... and 70 more: https://git.openjdk.org/jdk/compare/b530c0281b5082994065b10addeb8366ffa58e2f...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

johnshajiang · 2024-01-16T22:54:28Z

@seanjmullan
Thanks for your approval!

/integrate

openjdk · 2024-01-16T22:54:49Z

Going to push as commit 43d2d68.
Since your change was applied there have been 82 commits pushed to the master branch:

b058063: 8323820: [MacOS] build failure: non-void function does not return a value
19c9388: 8323616: [JVMCI] TestInvalidJVMCIOption.java fails intermittently with NPE
b533272: 8299627: Fix/improve handling of "missing" element-list file
1007618: 8323731: Unproblemlist gc/stress/TestStressG1Humongous.java
790871e: 8323800: Serial: Fix include guard macro in generation.hpp
0216f5d: 8323730: Tweak TestZAllocationStallEvent.java to allocate smaller objects
21f6473: 8322675: JFR: Fail-fast mode when constants cannot be resolved
e2d6023: 8323631: JfrTypeSet::write_klass can enqueue a CLD klass that is unloading
2fd775f: 8323651: compiler/c2/irTests/TestPrunedExHandler.java fails with -XX:+DeoptimizeALot
ee4d9aa: 8323659: LinkedTransferQueue add and put methods call overridable offer
... and 72 more: https://git.openjdk.org/jdk/compare/b530c0281b5082994065b10addeb8366ffa58e2f...master

Your commit was automatically rebased without conflicts.

openjdk · 2024-01-16T22:54:55Z

@johnshajiang Pushed as commit 43d2d68.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8320449: ECDHKeyAgreement should validate parameters before using them

8a57346

openjdk bot added the rfr Pull request is ready for review label Jan 11, 2024

openjdk bot added the security security-dev@openjdk.org label Jan 11, 2024

seanjmullan reviewed Jan 12, 2024

View reviewed changes

ecki reviewed Jan 13, 2024

View reviewed changes

johnshajiang added 2 commits January 13, 2024 10:17

more assertThrows on doPhase

68a53e8

Not use JUnit

9a32611

seanjmullan reviewed Jan 16, 2024

View reviewed changes

more check on generateSecret

2eb5fb4

seanjmullan approved these changes Jan 16, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Jan 16, 2024

openjdk bot added the integrated Pull request has been integrated label Jan 16, 2024

openjdk bot closed this Jan 16, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Jan 16, 2024

johnshajiang deleted the 8320449 branch January 16, 2024 22:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8320449: ECDHKeyAgreement should validate parameters before using them #17373

8320449: ECDHKeyAgreement should validate parameters before using them #17373

johnshajiang commented Jan 11, 2024 •

edited by openjdk bot

Loading

bridgekeeper bot commented Jan 11, 2024

openjdk bot commented Jan 11, 2024

mlbridge bot commented Jan 11, 2024 •

edited

Loading

seanjmullan Jan 12, 2024

johnshajiang Jan 12, 2024

seanjmullan Jan 12, 2024

seanjmullan Jan 12, 2024

johnshajiang Jan 13, 2024

seanjmullan Jan 14, 2024

johnshajiang Jan 15, 2024

ecki Jan 13, 2024

johnshajiang Jan 13, 2024

seanjmullan Jan 16, 2024

seanjmullan Jan 16, 2024

openjdk bot commented Jan 16, 2024

johnshajiang commented Jan 16, 2024

openjdk bot commented Jan 16, 2024

openjdk bot commented Jan 16, 2024

8320449: ECDHKeyAgreement should validate parameters before using them #17373

8320449: ECDHKeyAgreement should validate parameters before using them #17373

Conversation

johnshajiang commented Jan 11, 2024 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

Webrev

bridgekeeper bot commented Jan 11, 2024

openjdk bot commented Jan 11, 2024

mlbridge bot commented Jan 11, 2024 • edited Loading

Webrevs

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openjdk bot commented Jan 16, 2024

johnshajiang commented Jan 16, 2024

openjdk bot commented Jan 16, 2024

openjdk bot commented Jan 16, 2024

johnshajiang commented Jan 11, 2024 •

edited by openjdk bot

Loading

mlbridge bot commented Jan 11, 2024 •

edited

Loading