Bug ID: JDK-8248744 Second parameter of "initialize" method is not used

Type: Bug
Component: security-libs
Sub-Component: java.security
Affected Version: 8u251

Priority: P3
Status: Closed
Resolution: Duplicate

Submitted: 2020-06-20
Updated: 2023-11-29
Resolved: 2020-09-09

A DESCRIPTION OF THE PROBLEM :
This is in reference to bug JDK-8211049 which has been marked as closed, yet its just started happening in the latest release 8v251.  It was not an issue in 8v242.

REGRESSION : Last worked in version 8

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
			KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
			keyGen.initialize(nnn, mysecurerand);


CUSTOMER SUBMITTED WORKAROUND :
			KeyPairGenerator  keyGen = KeyPairGenerator.getInstance("RSA");
			keyGen.initialize(new RSAKeyGenParameterSpec(nnn, BigInteger.valueOf(65537)), mysecurerand);


FREQUENCY : always

Issue is tracked through JDK-8211049 and backported to 8u.
20-07-2020
Additional information from Submitter: =========================== RSAKeyPairGenerator Code in 242: package sun.security.rsa; ... public final class RSAKeyPairGenerator extends KeyPairGeneratorSpi { ... // initialize the generator. See JCA doc public void initialize(int keySize, SecureRandom random) { // do not allow unreasonably small or large key sizes, // probably user error try { RSAKeyFactory.checkKeyLengths(keySize, RSAKeyGenParameterSpec.F4, 512, 64 * 1024); } catch (InvalidKeyException e) { throw new InvalidParameterException(e.getMessage()); } this.keySize = keySize; this.random = random; this.publicExponent = RSAKeyGenParameterSpec.F4; } RSAKeyPairGenerator Code in 251: package sun.security.rsa; ... public abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi { ... // initialize the generator. See JCA doc public void initialize(int keySize, SecureRandom random) { try { initialize(new RSAKeyGenParameterSpec(keySize, RSAKeyGenParameterSpec.F4), null); } catch (InvalidAlgorithmParameterException iape) { throw new InvalidParameterException(iape.getMessage()); } } Please note 'random' parameter is ignored starting in 251 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Hope this helps indicate which initialize is getting called: KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(512, new MyAwsomeRandomGenerator());
17-07-2020
Behavior between OpenJDK 8u242 and Oracle JDK 8u251 should be same: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/4687075d8ccf/src/share/classes/sun/security/rsa/RSAKeyPairGenerator.java A working testcase from the submitter is required to understand which iniitialize(.....) is being called.
03-07-2020
Requested the test case from the submitter.
23-06-2020