JDK-8153005 : Upgrade the default PKCS12 encryption/MAC algorithms
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: java.security
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2016-03-29
  • Updated: 2022-07-29
  • Resolved: 2020-10-30
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 16 JDK 7 JDK 8
11.0.12-oracleFixed 16 b23Fixed 7u311Fixed 8u301Fixed
Related Reports
Blocks :  
CSR :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Sub Tasks
JDK-8242069 :  
JDK-8256507 :  
PKCS12 is a standard file format for storing keys and certs that is widely used by PKI applications. It has been available in the JDK for more than 15 years.

The default PKCS12 algorithms for confidentiality and integrity currently make use of SHA-1 hashes. SHA-1 is no longer universally recommended. We should examine supporting alternative algorithms that are stronger and that make use of SHA-2 hashes.

Interoperability concerns will also need to be examined before upgrading the default algorithms.
Fix Request (11u) Should get backported for parity with 11.0.12-oracle. CSR covers 11-pool and is approved. Change doesn't apply cleanly. Review thread: http://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-April/006024.html

Changeset: f77a6585 Author: Weijun Wang <weijun@openjdk.org> Date: 2020-10-30 13:23:33 +0000 URL: https://github.com/openjdk/jdk/commit/f77a6585

MSIE 11 has full support for strong algorithms and the NONE algorithm. Firefox supports strong algorithms on key protection and Mac but not certificate protection (strangely, pk12util does) but not NONE algorithm. Chrome uses operating system's keychain, and supports neither on Mac.

JDK-8006591 has already added a security property for the key encryption algorithm. We still need to add one for the Mac algorithm. Then we can adjust the default values.