Summary

Adds support for x25519/x448 Elliptic Curves (RFC 7748) to the JDK TLS implementation.

Problem

JEP 324 added KeyAgreement with ECC curves x25519/x448 to JDK 11. These curves have desirable properties:

...constant-time implementation and an
exception-free scalar multiplication that is resistant to a wide
range of side-channel attacks, including timing and cache attacks.

These curves were recently added to the various IETF Transport Layer Security (TLS) specifications:

• RFC 8422 adds these curves to these existing RFCs TLSv1/TLSv1.1/TLSv1.2

• RFC 8446 defines these curves as part of TLSv1.3

Currently, the JDK SunJSSE provider does not support these curves.

Solution

Add support for x25519/x448 in the SunJSSE implementation.

Almost all of the implementation changes are contained within the JDK internal SunJSSE provider code.

x25519 is the most preferred named group in Chrome, Firefox, Opera, and Edge, so we will follow suit.

Specification

x25519/x448 will be added to the list of "enabled by default" named curves.

The only externally noticeable item is that the strings "x25519" and "x448" are now recognized in the java.lang.System configuration property "jdk.tls.namedGroups":

jdk.tls.namedGroups="x25519, x448, secp521r1, secp256r1, ffdhe2048"

Proposed default ordered list of groups:

  // Primary XDH (RFC 7748) curves
  NamedGroup.X25519,

  // Primary NIST curves (i.e. used in TLSv1.3)
  NamedGroup.SECP256_R1,
  NamedGroup.SECP384_R1,
  NamedGroup.SECP521_R1,

  // Secondary XDH curves
  NamedGroup.X448,

  // Secondary NIST curves
  NamedGroup.SECT283_K1,
  NamedGroup.SECT283_R1,
  NamedGroup.SECT409_K1,
  NamedGroup.SECT409_R1,
  NamedGroup.SECT571_K1,
  NamedGroup.SECT571_R1,

  // non-NIST curves
  NamedGroup.SECP256_K1,

  // FFDHE 2048
  NamedGroup.FFDHE_2048,
  NamedGroup.FFDHE_3072,
  NamedGroup.FFDHE_4096,
  NamedGroup.FFDHE_6144,
  NamedGroup.FFDHE_8192,