Skip to content

Commit 9cf9879

Browse files
GoeLinGoeLin
committed
8267880: Upgrade the default PKCS12 MAC algorithm
Reviewed-by: mbaesken
1 parent e80c7e1 commit 9cf9879

File tree

4 files changed

+23
-23
lines changed

4 files changed

+23
-23
lines changed

‎src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,10 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
101101
= "PBEWithHmacSHA256AndAES_256";
102102
private static final String DEFAULT_KEY_PBE_ALGORITHM
103103
= "PBEWithHmacSHA256AndAES_256";
104-
private static final String DEFAULT_MAC_ALGORITHM = "HmacPBESHA1";
104+
private static final String DEFAULT_MAC_ALGORITHM = "HmacPBESHA256";
105105
private static final int DEFAULT_CERT_PBE_ITERATION_COUNT = 10000;
106106
private static final int DEFAULT_KEY_PBE_ITERATION_COUNT = 10000;
107-
private static final int DEFAULT_MAC_ITERATION_COUNT = 100000;
107+
private static final int DEFAULT_MAC_ITERATION_COUNT = 10000;
108108

109109
// Legacy settings. Used when "keystore.pkcs12.legacy" is set.
110110
private static final String LEGACY_CERT_PBE_ALGORITHM

‎src/java.base/share/conf/security/java.security‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1213,12 +1213,12 @@ jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep
12131213
# The algorithm used to calculate the optional MacData at the end of a PKCS12
12141214
# file. This can be any HmacPBE algorithm defined in the Mac section of the
12151215
# Java Security Standard Algorithm Names Specification. When set to "NONE",
1216-
# no Mac is generated. The default value is "HmacPBESHA1".
1217-
#keystore.pkcs12.macAlgorithm = HmacPBESHA1
1216+
# no Mac is generated. The default value is "HmacPBESHA256".
1217+
#keystore.pkcs12.macAlgorithm = HmacPBESHA256
12181218

12191219
# The iteration count used by the MacData algorithm. This value must be a
1220-
# positive integer. The default value is 100000.
1221-
#keystore.pkcs12.macIterationCount = 100000
1220+
# positive integer. The default value is 10000.
1221+
#keystore.pkcs12.macIterationCount = 10000
12221222

12231223
#
12241224
# Enhanced exception message information

‎test/jdk/sun/security/pkcs12/KeytoolOpensslInteropTest.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -169,8 +169,8 @@ private static void testWithJavaCommands() throws Throwable {
169169
keytool("-importkeystore -srckeystore ks -srcstorepass changeit "
170170
+ "-destkeystore ksnormal -deststorepass changeit");
171171
data = Files.readAllBytes(Path.of("ksnormal"));
172-
checkInt(data, "22", 100000); // Mac ic
173-
checkAlg(data, "2000", SHA_1); // Mac alg
172+
checkInt(data, "22", 10000); // Mac ic
173+
checkAlg(data, "2000", SHA_256); // Mac alg
174174
checkAlg(data, "110c010c01000", PBES2); // key alg
175175
checkInt(data, "110c010c01001011", 10000); // key ic
176176
checkAlg(data, "110c110110", PBES2); // cert alg
@@ -195,8 +195,8 @@ private static void testWithJavaCommands() throws Throwable {
195195
+ "-J-Dkeystore.pkcs12.certProtectionAlgorithm=NONE "
196196
+ "-J-Dkeystore.pkcs12.macAlgorithm=NONE");
197197
data = Files.readAllBytes(Path.of("ksnormal"));
198-
checkInt(data, "22", 100000); // Mac ic
199-
checkAlg(data, "2000", SHA_1); // Mac alg
198+
checkInt(data, "22", 10000); // Mac ic
199+
checkAlg(data, "2000", SHA_256); // Mac alg
200200
checkAlg(data, "110c010c01000", PBES2); // key alg
201201
checkInt(data, "110c010c01001011", 10000); // key ic
202202
checkAlg(data, "110c010c11000", PBES2); // new key alg
@@ -240,7 +240,7 @@ private static void testWithJavaCommands() throws Throwable {
240240
+ "-J-Dkeystore.pkcs12.keyPbeIterationCount=7777");
241241
data = Files.readAllBytes(Path.of("ksnewic"));
242242
checkInt(data, "22", 5555); // Mac ic
243-
checkAlg(data, "2000", SHA_1); // Mac alg
243+
checkAlg(data, "2000", SHA_256); // Mac alg
244244
checkAlg(data, "110c010c01000", PBES2); // key alg
245245
checkInt(data, "110c010c01001011", 7777); // key ic
246246
checkAlg(data, "110c110110", PBES2); // cert alg
@@ -257,7 +257,7 @@ private static void testWithJavaCommands() throws Throwable {
257257
+ "-J-Dkeystore.pkcs12.keyProtectionAlgorithm=PBEWithSHA1AndRC4_128");
258258
data = Files.readAllBytes(Path.of("ksnewic"));
259259
checkInt(data, "22", 5555); // Mac ic
260-
checkAlg(data, "2000", SHA_1); // Mac alg
260+
checkAlg(data, "2000", SHA_256); // Mac alg
261261
checkAlg(data, "110c010c01000", PBES2); // key alg
262262
checkInt(data, "110c010c01001011", 7777); // key ic
263263
checkAlg(data, "110c010c11000", PBEWithSHA1AndRC4_128); // new key alg
@@ -273,8 +273,8 @@ private static void testWithJavaCommands() throws Throwable {
273273
ks.store(fos, "changeit".toCharArray());
274274
}
275275
data = Files.readAllBytes(Path.of("ksnormaldup"));
276-
checkInt(data, "22", 100000); // Mac ic
277-
checkAlg(data, "2000", SHA_1); // Mac alg
276+
checkInt(data, "22", 10000); // Mac ic
277+
checkAlg(data, "2000", SHA_256); // Mac alg
278278
checkAlg(data, "110c010c01000", PBES2); // key alg
279279
checkInt(data, "110c010c01001011", 10000); // key ic
280280
checkAlg(data, "110c010c11000", PBES2); // new key alg
@@ -303,7 +303,7 @@ private static void testWithJavaCommands() throws Throwable {
303303
}
304304
data = Files.readAllBytes(Path.of("ksnewicdup"));
305305
checkInt(data, "22", 5555); // Mac ic
306-
checkAlg(data, "2000", SHA_1); // Mac alg
306+
checkAlg(data, "2000", SHA_256); // Mac alg
307307
checkAlg(data, "110c010c01000", PBES2); // key alg
308308
checkInt(data, "110c010c01001011", 7777); // key ic
309309
checkAlg(data, "110c010c11000", PBEWithSHA1AndRC4_128); // new key alg

‎test/jdk/sun/security/pkcs12/ParamsPreferences.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public static final void main(String[] args) throws Exception {
5757
Map.of(),
5858
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
5959
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
60-
SHA_1, 100000);
60+
SHA_256, 10000);
6161

6262
// legacy settings
6363
test(c++,
@@ -107,7 +107,7 @@ public static final void main(String[] args) throws Exception {
107107
"keystore.pkcs12.macAlgorithm", "NONE"),
108108
PBEWithSHA1AndDESede, 10000,
109109
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
110-
SHA_256, 100000);
110+
SHA_256, 10000);
111111

112112
// back to with storepass by using "" to force hardcoded default
113113
test(c++,
@@ -119,7 +119,7 @@ public static final void main(String[] args) throws Exception {
119119
"keystore.pkcs12.macAlgorithm", "NONE"),
120120
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
121121
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
122-
SHA_1, 100000);
122+
SHA_256, 10000);
123123

124124
// change everything with system property
125125
test(c++,
@@ -173,29 +173,29 @@ public static final void main(String[] args) throws Exception {
173173
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_128"),
174174
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
175175
PBEWithSHA1AndRC2_128, 10000,
176-
SHA_1, 100000);
176+
SHA_256, 10000);
177177
test(c++,
178178
Map.of(),
179179
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_128",
180180
"keystore.pkcs12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_40"),
181181
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
182182
PBEWithSHA1AndRC2_40, 10000,
183-
SHA_1, 100000);
183+
SHA_256, 10000);
184184
test(c++,
185185
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC4_128"),
186186
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_128",
187187
"keystore.pkcs12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_40"),
188188
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
189189
PBEWithSHA1AndRC4_128, 10000,
190-
SHA_1, 100000);
190+
SHA_256, 10000);
191191
test(c++,
192192
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC4_128",
193193
"keystore.pkcs12.keyProtectionAlgorithm", "PBEWithSHA1AndRC4_40"),
194194
Map.of("keystore.PKCS12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_128",
195195
"keystore.pkcs12.keyProtectionAlgorithm", "PBEWithSHA1AndRC2_40"),
196196
PBES2, HmacSHA256, AES_256$CBC$NoPadding, 10000,
197197
PBEWithSHA1AndRC4_40, 10000,
198-
SHA_1, 100000);
198+
SHA_256, 10000);
199199

200200
// 8266293
201201
test(c++,
@@ -204,7 +204,7 @@ public static final void main(String[] args) throws Exception {
204204
Map.of(),
205205
PBEWithMD5AndDES, 10000,
206206
PBEWithMD5AndDES, 10000,
207-
SHA_1, 100000);
207+
SHA_256, 10000);
208208
}
209209

210210
/**

0 commit comments

Comments
 (0)