RFR JDK-8029661: JDK-Support TLS v1.2 algorithm in SunPKCS11 provider

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

RFR JDK-8029661: JDK-Support TLS v1.2 algorithm in SunPKCS11 provider

Martin Balao
Hi,

I would like to propose a patch for JDK-8029661: JDK-Support TLS v1.2 algorithm in SunPKCS11 provider [1].


The following algorithms have been implemented in SunPKCS11 provider (based on PKCS#11 v2.40 mechanisms):

 * SunTls12RsaPremasterSecret
 * SunTls12MasterSecret
 * SunTls12KeyMaterial
 * SunTls12Prf

A minor API change is proposed to expose TLS ProtocolVersion constants (SSL30, TLS10, TLS11, etc.) from java.base to jdk.crypto.cryptoki module. This allows to remove hardcoded TLS int constants in SunPKCS11 classes (required when implementing "Tls"-like algorithms).

A test case is included with the following:

 * TLS 1.2 communication using SunPKCS11 + NSS (in FIPS mode)
 * Algorithms test against SunJCE

Regards,
Martin.-

--