Loading...

XML

Word

Printable

Type: Enhancement
Resolution: Fixed
Priority: P3
Fix Version/s: 15
Affects Version/s: 7, 8, 11, 15
Component/s: security-libs
Labels:

Subcomponent:
java.security
Resolved In Build:
b20

Issue	Fix Version	Assignee	Priority	Status	Resolution	Resolved In Build
JDK-8257217	13.0.9	Yuri Nesterenko	P3	Resolved	Fixed	b01
JDK-8243981	11.0.9-oracle	Sean Coffey	P3	Resolved	Fixed	b01
JDK-8246690	11.0.9	Goetz Lindenmaier	P3	Resolved	Fixed	b01
JDK-8258893	openjdk8u292	Severin Gehwolf	P3	Resolved	Fixed	b03
JDK-8243983	8u271	Sean Coffey	P3	Resolved	Fixed	b01
JDK-8251693	emb-8u271	Sean Coffey	P3	Resolved	Fixed	team
JDK-8243984	7u281	Sean Coffey	P3	Resolved	Fixed	b01

It would be useful to also start warning users that SHA-1 and 1024-bit RSA/DSA certificates are a security risk *before* we actually start disabling them.

We add a new jdk.security.legacyAlgorithms security property to the java.security property file. keytool and jarsigner tools will be enhanced to enforce the new property and to print out informational warnings when the legacy algorithms are used. This enables users to plan transitioning away from them. This would also allow a user to edit these properties independently so that you could still get warnings from tools even if the runtime allowed the algorithm.

backported by

JDK-8243981 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8243983 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8243984 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8246690 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8251693 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8257217 Tools should warn if weak algorithms are used before restricting them

Resolved

JDK-8258893 Tools should warn if weak algorithms are used before restricting them

Resolved

csr for

JDK-8238640 Tools should warn if weak algorithms are used before restricting them

Closed

relates to

JDK-8243493 Tools shouldn't warn for weak algorithms in cacerts

Closed

JDK-8245151 jarsigner should not raise duplicate warnings on verification

Closed

JDK-8263817 java.util.MissingResourceException if add cert with GOST key in cacerts

Resolved

JDK-8245665 Test WeakAlg.java should only make sure no warning for weak signature algorithms by keytool on root CA

Resolved

JDK-8260286 Manual Test "ws/open/test/jdk/sun/security/tools/jarsigner/compatibility/Compatibility.java" fails

Resolved

JDK-8255402 Warnings generated for JDK cacerts keystore

Closed

JDK-8240552 Update jarsigner and keytool man pages for the legacy algorithms

Closed

JDK-8263664 Remove root certificates with 1024-bit keys

Resolved

links to

Commit openjdk/jdk13u-dev/dd3d55e5

Review openjdk/jdk13u-dev/237

(2 backported by, 1 csr for, 8 relates to, 2 links to)

Release Note: Tools Warn If Weak Algorithms Are Used

Closed

Haimay Chao

Assignee:: Haimay Chao

Reporter:: Weijun Wang

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Created:: 2017-01-08 23:35

Updated:: 2023-12-04 14:37

Resolved:: 2020-04-17 05:16

Details

Backports

Description

Attachments

Issue Links

Sub-Tasks

Activity

People

Dates