-
Sub-task
-
Resolution: Delivered
-
P3
-
7u361, 8u351, 11.0.17-oracle
| Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
|---|---|---|---|---|---|---|
| JDK-8293954 | 8u351 | Prasadarao Koppula | P3 | Resolved | Delivered | |
| JDK-8293953 | 7u361 | Prasadarao Koppula | P3 | Resolved | Delivered |
The default MAC algorithm used in a PKCS #12 keystore has been updated. The new algorithm is based on SHA-256 and is stronger than the old one based on SHA-1. See the security properties starting with `keystore.pkcs12` in the `java.security` file for detailed information.
The new SHA-256 based MAC algorithms were introduced in the 11.0.12, 8u301, and 7u311 JDK versions. Keystores created using this newer, stronger, MAC algorithm cannot be opened in JDK versions earlier than 11.0.12, 8u301, and 7u311. A 'java.security.NoSuchAlgorithmException' exception will be thrown in such circumstances.
For compatibility, use the `keystore.pkcs12.legacy` system property, which will revert the algorithms to use the older, weaker algorithms. There is no value defined for this property.
The new SHA-256 based MAC algorithms were introduced in the 11.0.12, 8u301, and 7u311 JDK versions. Keystores created using this newer, stronger, MAC algorithm cannot be opened in JDK versions earlier than 11.0.12, 8u301, and 7u311. A 'java.security.NoSuchAlgorithmException' exception will be thrown in such circumstances.
For compatibility, use the `keystore.pkcs12.legacy` system property, which will revert the algorithms to use the older, weaker algorithms. There is no value defined for this property.
- backported by
-
-
- Resolved
-
-
-
- Resolved
-
[JDK-8288297] Release Note: Upgrade the Default PKCS12 MAC Algorithm
Change title to title case, assigned a fix version to the main task, added backports for the remaining affected versions.