infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-01-28 03:58:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

8371156: PBKDF2 default values should not be DER encoded

Browse Source 
Reviewed-by: weijun
This commit is contained in:
Mark Powers 2025-11-17 14:59:30 +00:00
parent 6385c663dc
commit 52ffe8a096
3 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/java.base/share/classes/sun/security/util/PBKDF2Parameters.java
View File

@ -27,7 +27,6 @@ package sun.security.util;
import java.io.IOException;
import sun.security.util.KnownOIDs;
import sun.security.x509.AlgorithmId;
/**
@ -164,7 +163,10 @@ public final class PBKDF2Parameters {
tmp0.putInteger(keyLength);
// prf AlgorithmIdentifier {{PBKDF2-PRFs}}
tmp0.write(new AlgorithmId(prf));
// HmacSHA1 is the default and must not be encoded.
if (!prf.equals(ObjectIdentifier.of(KnownOIDs.HmacSHA1))) {
tmp0.write(new AlgorithmId(prf));
}
// id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12}
out.putOID(ObjectIdentifier.of(KnownOIDs.PBKDF2));

12
test/jdk/sun/security/pkcs12/ImportPassKeyAlg.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -23,7 +23,7 @@
/*
* @test
* @bug 8286069
* @bug 8286069 8371156
* @summary keytool prints out wrong key algorithm for -importpass command
* @library /test/lib
* @modules java.base/sun.security.util
@ -92,7 +92,7 @@ public class ImportPassKeyAlg {
// 0034:0004 [1011] INTEGER 10000
// 0038:0003 [1012] INTEGER 16
// 003B:000E [1013] SEQUENCE
// 003D:000A [10130] OID 1.2.840.113549.2.7 (HmacSHA1)
// 003D:000A [10130] OID 1.2.840.113549.2.9 (HmacSHA256)
// 0047:0002 [10131] NULL
// 0049:001F [11] SEQUENCE
// 004B:000B [110] OID 2.16.840.1.101.3.4.1.2 (AES_128/CBC/NoPadding)
@ -100,7 +100,11 @@ public class ImportPassKeyAlg {
var data = Files.readAllBytes(Path.of(name));
DerUtils.checkAlg(data, "110c010c01010c00", oids[0]);
if (oids[0] == KnownOIDs.PBES2) {
DerUtils.checkAlg(data, "110c010c01010c010130", oids[1]);
if (oids[1] == KnownOIDs.HmacSHA1) {
DerUtils.shouldNotExist(data, "110c010c01010c010130");
} else {
DerUtils.checkAlg(data, "110c010c01010c010130", oids[1]);
}
DerUtils.checkAlg(data, "110c010c01010c0110", oids[2]);
}
}

10
test/jdk/sun/security/pkcs12/PBMAC1Test.java
View File

@ -116,6 +116,16 @@ public class PBMAC1Test {
var reason = Asserts.assertThrows(NoSuchAlgorithmException.class,
() -> emptyP12()).getMessage();
Asserts.assertTrue(reason.contains("Algorithm hmacsha456 not available"), reason);
// Verify that DEFAULT HmacSHA1 prf does not get encoded.
System.setProperty("keystore.pkcs12.macAlgorithm", "PBEWITHHMACSHA1");
der = emptyP12();
DerUtils.checkAlg(der, "2000", KnownOIDs.PBMAC1);
DerUtils.checkAlg(der, "200100", KnownOIDs.PBKDF2);
DerUtils.shouldNotExist(der, "20010130");
DerUtils.checkAlg(der, "200110", KnownOIDs.HmacSHA1);
DerUtils.checkInt(der, "2001011", 10000);
DerUtils.checkInt(der, "2001012", 20);
}
static void migrate() throws Exception {