Summary
-------

Facilitate migrating data from JKS and JCEKS keystores by adding equivalent
support to the PKCS#12 keystore. Enhance the KeyStore API to support new
features such as entry metadata and logical views spanning several keystores.
Enable the strong crypto algorithms introduced in JEP-121 to be used to
protect keystore entries.


Motivation
----------

Simplify the task of interacting with Java SE keystores for cryptographic
applications, and ease their development and deployment.

The current default keystore format is Java-specific and is not supported
outside of Java SE.  Applications are burdened with convering to and from
our format.  Facilitating easy migration to an open, widely-supported format
would enhance interoperability with Java SE.


Description
-----------

Java SE enforces security using cryptographic information stored in
keystores.  A variety of keystore implementations are currently
supported. The default keystore format is called Java Key Store
(JKS). JKS is a Java-specific format that is robust and has served the
platform well since its inception.  However, it suffers from some
limitations and should be updated.

PKCS#12 is a more suitable format to use as the default Java SE
keystore. It is an open specification which is widely supported by
operating systems, PKI tools, and web browsers. Although it is a keystore
format that is already supported in Java SE, several enhancements are
required to enable trusted certificates and secret keys to be stored.

In addition, there is a long-standing requirement to support logical
keystores that span several physical keystores.  A logical keystore
eliminates the requirement to manage groups of keystores directly.


Testing
-------

Ensure that the Mozilla OpenSSL Crypto Toolkit and popular web browsers
can interact with our PKCS#12 format.