Summary

The Java Security Standard Algorithm Names specification should be clarified to state that, as a best practice, implementations that support additional algorithms not defined in the specification can and should use the standard name of those algorithms if they are defined in later versions of the specification.

Problem

The security landscape changes at a fast pace, and new and stronger algorithms and protocols are constantly being developed and standardized.
With this proposed change, we will clarify that implementations that support additional algorithms are recommended to use the standard name of those algorithms if they have been added to subsequent versions of the Java Security Standard Algorithm Names specification.

Solution

See the specification section. This change will be included in the upcoming Maintenance Reviews of the Java SE 8 and 11 Platform JSRs. See https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2018-December/000308.html for more information.

This change is targeted for Java SE 8, 11 and 12 and is the same across all releases. This CSR is intended to cover both 11 and 12, thus the fixVersion has been set to 11-pool and 12. A separate CCC will be filed and targeted to 8-pool.

Specification

Add the following sentence to the first section ("Standard Names") of the Java Security Standard Algorithm Names specification:

Note that an SE implementation may support additional algorithms
that are not defined in this specification.  As a best practice, if an
algorithm is defined in a subsequent version of this specification and
an implementation of an earlier specification supports that algorithm,
the implementation should use the standard name of the algorithm
that is defined in the subsequent specification.  Each SE implementation
should also document the algorithms that it supports or adds support
for in subsequent update releases.  The algorithms may be documented
in release notes or in a separate document such as the JDK Security
Providers document.

With this change, the first section is now the following:

The Java SE Security API requires and uses a set of standard
names for algorithms, certificate and keystore types.

Note that an SE implementation may support additional algorithms
that are not defined in this specification.  As a best practice, if an
algorithm is defined in a subsequent version of this specification and
an implementation of an earlier specification supports that algorithm,
the implementation should use the standard name of the algorithm
that is defined in the subsequent specification.  Each SE implementation
should also document the algorithms that it supports or adds support
for in subsequent update releases.  The algorithms may be documented
in release notes or in a separate document such as the JDK Security
Providers document.

In some cases naming conventions are given for forming names
that are not explicitly listed, to facilitate name consistency
across provider implementations. Items in angle brackets (such as
<digest> and <encryption>) are placeholders to be replaced by a
specific message digest, encryption algorithm, or other name.

Note: Standard names are not case-sensitive.