JDK-8130132 : jarsigner should emit warning if weak algorithms or keysizes are used
- Type: Enhancement
- Component: security-libs
- Sub-Component: java.security
- Priority: P3
- Status: Closed
- Resolution: Fixed
- Submitted: 2015-06-30
- Updated: 2018-11-14
- Resolved: 2015-12-02
The Version table provides details related to the release that this issue/RFE will be addressed.
Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.
To download the current JDK release, click here.
Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.
To download the current JDK release, click here.
| JDK 7 | JDK 8 | JDK 9 | Other |
|---|---|---|---|
| 7u211Fixed | 8u191Fixed  |
9 b96Fixed |
openjdk7uFixed |
Related Reports
|
Relates :
|
|
|
Relates :
|
Description
The jarsigner tool should warn the user if a weak cryptographic algorithm is used, such as MD2 or MD5, or a weak keysize, such as RSA/DSA keys less than 1024 bits. This should apply to the key and certificate, and the digest and signature algorithms used to sign the JAR. We should still allow the JAR to be signed, but a warning indicating the risks of using a weak algorithm should emitted. Rather than hard-coding the algorithms, one way to implement this is to read the value of the jdk.certpath.disabledAlgorithms. Although this property is intended to only apply to certificates, the same restrictions are generally applicable to the algorithms used to sign code.
Comments
|