JDK-8203228 : Branch-free output conversion for X25519 and X448
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: javax.crypto
  • Affected Version: 7,8,11,12
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2018-05-15
  • Updated: 2019-09-04
  • Resolved: 2018-06-26
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 12 JDK 7 JDK 8 Other
11 b20Fixed 12Fixed 7u231Fixed 8u221Fixed openjdk7uFixed
The existing X25519 and X448 implementations do not branch during the group operations. However, converting the resulting group element to a byte array currently uses BigInteger. Removing the branching from this operation will make the implementation more resistant to side-channel attacks, and possibly more efficient.

This is an implementation change only, and the correctness can be verified by running the existing regression tests for X25519/X448 and the underlying field arithmetic.
Taking this one for 8u

Updating label on this bug to noreg-hard as there is no way to test branching. Current ECC tests can be used to verify that new implementation still works.