Summary

Update the java.security.interfaces.DSAKeyPairGenerator class to remove the hard-coded default key size (1024-bit) when no initialize call is made and add 2048-bit to the list of key lengths supported across JDK releases.

Problem

Current javadoc specifies that 1024 is used as default key size if no initialize(...) call is made. This hard-coded value is insecure for modern-day computing power and is inconsistent to other security classes whose default values are provider-specific.

Solution

Update the javadoc to indicate that provider-specific default value will be used when no initialize(...) call is made.

Specification

Update the java.security.interfaces.DSAKeyPairGenerator class as below:
1) replace the hard-coded value of 1024 with provider-default value.

@@ -30,13 +30,16 @@
 /**
  * An interface to an object capable of generating DSA key pairs.
  *
  * <p>The {@code initialize} methods may each be called any number
  * of times. If no {@code initialize} method is called on a
- * DSAKeyPairGenerator, the default is to generate 1024-bit keys, using
- * precomputed p, q and g parameters and an instance of SecureRandom as
- * the random bit source.
+ * DSAKeyPairGenerator, each provider that implements this interface
+ * should supply (and document) a default initialization. Note that
+ * defaults may vary across different providers. Additionally, the default
+ * value for a provider may change in a future version. Therefore, it is
+ * recommended to explicitly initialize the DSAKeyPairGenerator instead
+ * of relying on provider-specific defaults. 
  *
  * <p>Users wishing to indicate DSA-specific parameters, and to generate a key
  * pair suitable for use with the DSA algorithm typically
  *
  * <ol>

2) should check the returned object is an instance of this interfaces before using it as such.

@@ -45,12 +48,13 @@
  * KeyPairGenerator {@code getInstance} method with "DSA"
  * as its argument.
  *
- * <li>Initialize the generator by casting the result to a DSAKeyPairGenerator
- * and calling one of the
- * {@code initialize} methods from this DSAKeyPairGenerator interface.
+ * <li>Check if the returned key pair generator is an instance of
+ * DSAKeyPairGenerator before casting the result to a DSAKeyPairGenerator
+ * and calling one of the {@code initialize} methods from this
+ * DSAKeyPairGenerator interface.
  *
  * <li>Generate a key pair by calling the {@code generateKeyPair}
- * method from the KeyPairGenerator class.
+ * method of the KeyPairGenerator class.
  *
  * </ol>
  *

3) 2048-bit DSA size is becoming the norm.

@@ -61,11 +65,11 @@
  * in the KeyPairGenerator
  * interface is all that is needed when you accept defaults for algorithm-specific
  * parameters.
  *
  * <p>Note: Some earlier implementations of this interface may not support
- * larger sizes of DSA parameters such as 2048 and 3072-bit.
+ * larger values of DSA parameters such as 3072-bit.
  *
  * @since 1.1
  * @see java.security.KeyPairGenerator
  */
 public interface DSAKeyPairGenerator {

4) the list of supported key sizes is provider-specific and can't be guaranteed.

@@ -95,12 +99,11 @@
      * <p>If {@code genParams} is true, this method generates new
      * p, q and g parameters. If it is false, the method uses precomputed
      * parameters for the modulus length requested. If there are no
      * precomputed parameters for that modulus length, an exception will be
-     * thrown. It is guaranteed that there will always be
-     * default parameters for modulus lengths of 512 and 1024 bits.
+     * thrown.
      *
      * @param modlen the modulus length in bits. Valid values are any
      * multiple of 64 between 512 and 1024, inclusive, 2048, and 3072.
      *
      * @param random the random bit source to use to generate key bits;