Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8136720

The PKIX KeyManagerFactory algorithm is underspecified

XMLWordPrintable

    • Icon: Enhancement Enhancement
    • Resolution: Unresolved
    • Icon: P3 P3
    • None
    • None
    • security-libs
    • None

      The PKIX KeyManagerFactory algorithm is underspecified. It does not provide sufficient information for an independent implementation to be compatible. The standard algorithm document [1] says:

      "A factory for X509ExtendedKeyManagers that manage X.509 certificate-based key pairs for local side authentication according to the rules defined by the IETF PKIX working group in RFC 3280 or its successor. The KeyManagerFactory must support initialization using the class javax.net.ssl.KeyStoreBuilderParameters."

      The OpenJDK implementation never calls a PKIX CertPathValidator or CertPathBuilder. It needs to be more specific that it is a filtering mechanism, and avoids selecting certificates that would not be PKIX compliant. It also needs to be more specific about how it uses the KeyStoreBuilderParameters.

      [1] http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyManagerFactory

            hchao Haimay Chao
            mullan Sean Mullan
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: