Skip to content

Commit 887b7d4

Browse files
committed
Revert Enable ECDSA ciphers when running with FIPS cryptography
Revert PR ibmruntimes/openj9-openjdk-jdk#705 to sync the upstream behavior. Signed-off-by: Jinhang Zhang <Jinhang.Zhang@ibm.com>
1 parent f41c103 commit 887b7d4

File tree

1 file changed

+2
-55
lines changed

1 file changed

+2
-55
lines changed

src/java.base/share/classes/sun/security/ssl/JsseJce.java

Lines changed: 2 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -23,19 +23,14 @@
2323
* questions.
2424
*/
2525

26-
/*
27-
* ===========================================================================
28-
* (c) Copyright IBM Corp. 2023, 2023 All Rights Reserved
29-
* ===========================================================================
30-
*/
31-
3226
package sun.security.ssl;
3327

3428
import java.math.BigInteger;
3529
import java.security.*;
3630
import java.security.interfaces.RSAPublicKey;
3731
import java.security.spec.*;
3832
import javax.crypto.*;
33+
import javax.swing.text.Utilities;
3934

4035
/**
4136
* This class contains a few static methods for interaction with the JCA/JCE
@@ -96,26 +91,6 @@ final class JsseJce {
9691
*/
9792
static final String SIGNATURE_ECDSA = "SHA1withECDSA";
9893

99-
/**
100-
* JCA identifier string for ECDSA, i.e. a ECDSA with SHA224.
101-
*/
102-
static final String SIGNATURE_ECDSA_224 = "SHA224withECDSA";
103-
104-
/**
105-
* JCA identifier string for ECDSA, i.e. a ECDSA with SHA256.
106-
*/
107-
static final String SIGNATURE_ECDSA_256 = "SHA256withECDSA";
108-
109-
/**
110-
* JCA identifier string for ECDSA, i.e. a ECDSA with SHA384.
111-
*/
112-
static final String SIGNATURE_ECDSA_384 = "SHA384withECDSA";
113-
114-
/**
115-
* JCA identifier string for ECDSA, i.e. a ECDSA with SHA512.
116-
*/
117-
static final String SIGNATURE_ECDSA_512 = "SHA512withECDSA";
118-
11994
/**
12095
* JCA identifier for EdDSA signatures.
12196
*/
@@ -188,38 +163,10 @@ private static class EcAvailability {
188163
// Is EC crypto available?
189164
private static final boolean isAvailable;
190165

191-
/**
192-
* Checks if a particular signature algorithm is available.
193-
*
194-
* @param algorithm the algorithm we will attempt to instantiate to check if it is available
195-
* @return true if the signature algorithm is found, false otherwise
196-
*/
197-
private static boolean isSignatureAlgorithmAvailable(String algorithm) {
198-
try {
199-
// Attempt to create a Cipher instance with the specified algorithm.
200-
Signature.getInstance(algorithm);
201-
return true;
202-
} catch (NoSuchAlgorithmException e) {
203-
return false;
204-
}
205-
}
206-
207166
static {
208167
boolean mediator = true;
209168
try {
210-
// When running in FIPS mode, the signature "SHA1withECDSA" is not
211-
// available by default. In this scenario we should still set EC
212-
// availability to true since other algorithms in the ECDSA signature
213-
// family are available for use in various ECDSA TLS ciphers. All
214-
// FIPS solutions are expected to have an algorithm such as
215-
// "SHA512withECDSA", "SHA384withECDSA", "SHA256withECDSA", or
216-
// "SHA224withECDSA" available so we will also check for these algorithms.
217-
mediator = isSignatureAlgorithmAvailable(SIGNATURE_ECDSA)
218-
|| isSignatureAlgorithmAvailable(SIGNATURE_ECDSA_224)
219-
|| isSignatureAlgorithmAvailable(SIGNATURE_ECDSA_256)
220-
|| isSignatureAlgorithmAvailable(SIGNATURE_ECDSA_384)
221-
|| isSignatureAlgorithmAvailable(SIGNATURE_ECDSA_512);
222-
169+
Signature.getInstance(SIGNATURE_ECDSA);
223170
Signature.getInstance(SIGNATURE_RAWECDSA);
224171
KeyAgreement.getInstance("ECDH");
225172
KeyFactory.getInstance("EC");

0 commit comments

Comments
 (0)