Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8365820

Apply certificate scope constraints to algorithms in "signature_algorithms" extension when "signature_algorithms_cert" extension is not being sent

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: P4 P4
    • tbd
    • 25
    • security-libs
    • None

      JDK-8349583 implementation assumes that OpenJDK client always sends "signature_algorithms_cert" extension together with "signature_algorithms" extension. But we didn't account for `jdk.tls.client.disableExtensions` and `jdk.tls.server.disableExtensions` system properties which can disable producing "signature_algorithms_cert" extension. This is an issue similar to JDK-8355779 but on the extension producing side.

      Per TLSv1.3 RFC:
         -------
         If no "signature_algorithms_cert" extension is
         present, then the "signature_algorithms" extension also applies to
         signatures appearing in certificates.
         -------

            abarashev Artur Barashev
            abarashev Artur Barashev
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: