-
Sub-task
-
Resolution: Delivered
-
P4
-
6u141, 7u131, 8u121, 9
-
Verified
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8171037 | 8u121 | Clifford Wayne | P4 | Closed | Delivered | |
JDK-8171036 | 7u131 | Clifford Wayne | P4 | Closed | Delivered | |
JDK-8171035 | 6u141 | Clifford Wayne | P4 | Closed | Delivered |
The jarsigner tool has been enhanced to show details of the algorithms and keys used to generate a signed JAR file and will also provide an indication if any of them are considered weak.
Specifically, when "jarsigner -verify -verbose filename.jar" is called, a separate section is printed out showing information of the signature and timestamp (if it exists) inside the signed JAR file, even if it is treated as unsigned for various reasons. If any algorithm or key used is considered weak, as specified in the Security property `jdk.jar.disabledAlgorithms`, it will be labeled with "(weak)".
For example:
```
- Signed by "CN=weak_signer"
Digest algorithm: MD2 (weak)
Signature algorithm: MD2withRSA (weak), 512-bit key (weak)
Timestamped by "CN=strong_tsa" on Mon Sep 26 08:59:39 CST 2016
Timestamp digest algorithm: SHA-256
Timestamp signature algorithm: SHA256withRSA, 2048-bit key
```
Specifically, when "jarsigner -verify -verbose filename.jar" is called, a separate section is printed out showing information of the signature and timestamp (if it exists) inside the signed JAR file, even if it is treated as unsigned for various reasons. If any algorithm or key used is considered weak, as specified in the Security property `jdk.jar.disabledAlgorithms`, it will be labeled with "(weak)".
For example:
```
- Signed by "CN=weak_signer"
Digest algorithm: MD2 (weak)
Signature algorithm: MD2withRSA (weak), 512-bit key (weak)
Timestamped by "CN=strong_tsa" on Mon Sep 26 08:59:39 CST 2016
Timestamp digest algorithm: SHA-256
Timestamp signature algorithm: SHA256withRSA, 2048-bit key
```
- backported by
-
JDK-8171035 Release Note: jarsigner -verbose -verify should print the algorithms used to sign the jar
-
- Closed
-
-
JDK-8171036 Release Note: jarsigner -verbose -verify should print the algorithms used to sign the jar
-
- Closed
-
-
JDK-8171037 Release Note: jarsigner -verbose -verify should print the algorithms used to sign the jar
-
- Closed
-