JDK-8138653 : Default key sizes for the AlgorithmParameterGenerator and KeyPairGenerator implementations should be upgraded
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 9
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2015-09-30
  • Updated: 2017-05-17
  • Resolved: 2016-03-07
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 9
9 b109Fixed
Related Reports
Duplicate :  
JDK-8015328 - Generate 2048 bit RSA and DSA keys by default
Relates :  
JDK-8142541 - [TESTBUG] TestECDH.java and TestECDSA.java fail on multiple Linux platforms
Relates :  
JDK-8151405 - Doc changes for JDK-8138653
Sub Tasks
JDK-8159998 :  
Release Note: Default key sizes for the AlgorithmParameterGenerator and KeyPairGenerator implementations updated - Closed
Description
The default key size for the RSA and DiffieHellman AlgorithmParameterGenerator and KeyPairGenerator implementations should be increased from 1024 bits to 2048 bits.

The key size for the DSA AlgorithmParameterGenerator and KeyPairGenerator implementations is not yet being increased from 1024 to 2048 bits. This is due to concerns that the larger key sizes may be incompatible with the SHA1withDSA signature algorithm (which could break existing code), and also because some native pkcs11 implementations such as NSS and Solaris do not yet support SHA-2 signature algorithms for DSA.
Comments
Suggested Release Note: To improve security, the default key size for the RSA and DiffieHellman KeyPairGenerator implementations and the DiffieHellman AlgorithmParameterGenerator implementations has been increased from 1024 bits to 2048 bits. The default key size for the DSA KeyPairGenerator and AlgorithmParameterGenerator implementations remains at 1024 bits to preserve compatibility with applications that are using keys of that size with the SHA1withDSA signature algorithm. With increases in computing power and advances in cryptography, the minimum recommended key size goes up over time. Therefore, future versions of the platform may increase the default size.
01-03-2016