JEP 229: Create PKCS12 Keystores by DefaultJEP 229: Create PKCS12 Keystores by DefaultOwnerVincent RyanTypeFeatureScopeSEStatusClosed / DeliveredRelease9Componentsecurity-libs / java.securityDiscussionsecurity dash dev at openjdk dot java dot netEffortMDurationMReviewed byBrian Goetz, Sean MullanEndorsed byBrian GoetzCreated2014/05/30 16:28Updated2018/01/11 15:34Issue8044445Summary
Transition the default keystore type from JKS to PKCS12.
Goals


Improve security.  PKCS12 offers stronger cryptographic algorithms
than JKS.


Maintain forward and backward compatibility.  Applications that
access JKS and PKCS12 keystores must continue to function across
JDK releases.


Motivation
JKS is a custom, JDK-specific keystore type. It has been the default
keystore type for the Java platform since JDK 1.2. JKS keystores can only
store private keys and trusted public-key certificates, and they are
based on a proprietary format that is not easily extensible to new
cryptographic algorithms.
PKCS12 is an extensible, standard, and widely-supported format
for storing cryptographic keys. As of JDK 8, PKCS12 keystores can store
private keys, trusted public key certificates, and secret keys. Switching
to PKCS12 improves keystore integrity and confidentiality. It also opens
opportunities for interoperability with other systems that also support
PKCS12.
Description
This feature changes the default keystore type from JKS to PKCS12. By
default, new keystores will be created in the PKCS12 keystore
format. Existing keystores will not change and keystore applications can
continue to explicitly specify the keystore type they require.
Existing applications must not be disrupted. Keystores tend to be
long-lived, so we need to support access across several JDK
releases. Applications that access keystores created by earlier JDK
releases must run unaltered on JDK 9. Similarly, applications that access
keystores created by JDK 9 should run unaltered on earlier JDK releases.
This requirement is achieved by introducing a keystore detection
mechanism that understands both the JKS and PKCS12 formats. A keystore's
format is examined before it is loaded to determine its type and then the
appropriate keystore implementation is used to access it. The mechanism
is enabled by default but can be disabled if required.
Support for this keystore-detection mechanism may be backported to
earlier JDK releases.
Testing
Significant testing is required across JDK releases to ensure that
compatibility is maintained for applications that access keystores.
InstallingContributingSponsoringDevelopers' GuideVulnerabilitiesJDK GA/EA BuildsMailing listsWiki
                      · IRCBylaws · CensusLegalWorkshopJEP ProcessSource codeMercurialGitHubToolsGitjtreg harnessGroups(overview)AdoptionBuildClient LibrariesCompatibility & Specification ReviewCompilerConformanceCore LibrariesGoverning BoardHotSpotIDE Tooling & SupportInternationalizationJMXMembersNetworkingPortersQualitySecurityServiceabilityVulnerabilityWebProjects(overview,
      archive)AmberBabylonCRaCCaciocavalloClosuresCode ToolsCoinCommon VM InterfaceCompiler GrammarDetroitDevelopers' GuideDevice I/ODukeGalahadGraalIcedTeaJDK 7JDK 8JDK 8 UpdatesJDK 9JDK
      (…,
       21,
       22,
       23)JDK UpdatesJavaDoc.NextJigsawKonaKullaLambdaLanaiLeydenLilliputLocale EnhancementLoomMemory Model UpdateMetropolisMission ControlMulti-Language VMNashornNew I/OOpenJFXPanamaPenrosePort: AArch32Port: AArch64Port: BSDPort: HaikuPort: Mac OS XPort: MIPSPort: MobilePort: PowerPC/AIXPort: RISC-VPort: s390xPortolaSCTPShenandoahSkaraSumatraTiered AttributionTsanType AnnotationsValhallaVeronaVisualVMWakefieldZeroZGC

        © 2024 Oracle Corporation and/or its affiliates
        Terms of Use
        ·
        
            License: GPLv2
        · Privacy
        · Trademarks
