JDK-8346684 : Add TLSv1.3 and CNSA 1.0 algorithms to implementation requirements
  • Type: CSR
  • Component: security-libs
  • Sub-Component: java.security
  • Priority: P3
  • Status: Draft
  • Resolution: Unresolved
  • Fix Versions: 25
  • Submitted: 2024-12-19
  • Updated: 2025-01-06
Related Reports
CSR :  
JDK-8283795 - Add TLSv1.3 and CNSA 1.0 algorithms to implementation requirements
Description
Summary
-------

Add more cryptographic algorithms and protocols to the SE implementation requirements as specified in the security APIs and Standard Algorithm Names Specification.

Problem
-------

Periodically, we review the algorithm requirements to see if new algorithms should be added or existing ones should be removed. The requirements are intended to improve interoperability across different SE implementations by requiring a set of commonly used algorithms. The algorithms are not always based on the strength of the algorithm; the requirements are also based on how common the algorithms are, so some weaker algorithms are still on the list in order to support legacy use cases.

Solution
--------

Add TLSv1.3 to the list of requirements. TLSv1.3 is the most secure protocol version and is in wide use. Add all cryptographic algorithms that are needed to implement the TLSv1.3 cipher suites and signature mechanisms that are defined by https://www.rfc-editor.org/rfc/rfc8446 as MUST or SHOULD requirements. Finally, add algorithms that are required by CNSA 1.0 which was added in JDK 19: https://bugs.openjdk.org/browse/JDK-8267319.

No required algorithms or protocols are being removed at this time.

Specification
-------------
The following requirements will be added to the Security Algorithm Implementation Requirements section of the Java Security Standard Algorithm Names specification and to the class summary of each of the APIs below.

- AlgorithmParameters	
 - ChaCha20-Poly1305
 - EC with secp256r1 or secp384r1 curves
 - RSASSA-PSS with MGF1 mask generation function and SHA-256 or SHA-384 hash algorithm

- Cipher	
 - AES/GCM/NoPadding with 256 bit key size
 - ChaCha20-Poly1305

- KeyAgreement	
 - ECDH with secp256r1 or secp384r1 curves
 - X25519

- KeyFactory	
 - EC
 - RSASSA-PSS
 - X25519

- KeyGenerator	
 - AES with 256 bit key size
 - ChaCha20

- KeyPairGenerator
 - DH with 3072 bit key size
 - EC with secp256r1 or secp384r1 curves
 - RSA with 3072 bit key size
 - RSASSA-PSS with 2048, 3072, 4096 bit key sizes
 - X25519

- MessageDigest	
 - SHA-384

- Signature	
 - RSASSA-PSS with MGF1 mask generation function and SHA-256 or SHA-384 hash algorithm
 - SHA256WithECDSA with secp256r1 curve
 - SHA384WithECDSA with secp384r1 curve
 - SHA384WithRSA

- SSLContext	
 - TLSv1.3
Comments
Just one minor nit: "Periodically, we review the algorithm requirements..." Maybe de-personalize this by removing the "we" out of it. Perhaps, "Periodically, the algorithm requirements are reviewed..." Aside from that it looks good.
06-01-2025