8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

ascarpino · 2025-09-08T15:42:13Z

Hi

Please review the Second Preview for the PEM API. The most significant changes from JEP 470 are:

Renamed the name of PEMRecord class to PEM.
Revised the new encryptKey methods of the EncryptedPrivateKeyInfo class to accept DEREncodable objects rather than just PrivateKey objects so that cryptographic objects with public keys, i.e., KeyPair and PKCS8EncodedKeySpec, can also be encrypted.
Enhanced the PEMEncoder and PEMDecoder classes to support the encryption and decryption of KeyPair and PKCS8EncodedKeySpec objects.

thanks

Tony

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change requires CSR request JDK-8367431 to be approved
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issues

JDK-8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) (Enhancement - P4)
JDK-8367431: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) (CSR)

Reviewers

Weijun Wang (@wangweij - Reviewer)

Reviewers without OpenJDK IDs

@koushikthirupattur (no known openjdk.org user name / role)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/27147/head:pull/27147
$ git checkout pull/27147

Update a local copy of the PR:
$ git checkout pull/27147
$ git pull https://git.openjdk.org/jdk.git pull/27147/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 27147

View PR using the GUI difftool:
$ git pr show -t 27147

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/27147.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-09-08T15:43:23Z

👋 Welcome back ascarpino! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-09-08T15:44:08Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2025-09-08T15:44:55Z

@ascarpino The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

ascarpino · 2025-09-11T00:23:24Z

/csr

openjdk · 2025-09-11T00:24:29Z

@ascarpino has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@ascarpino please create a CSR request for issue JDK-8360564 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

mlbridge · 2025-09-11T16:58:57Z

Webrevs

wangweij

Some comments.

test/jdk/javax/crypto/EncryptedPrivateKeyInfo/GetKeyPair.java

wangweij · 2025-09-12T17:50:58Z

src/java.base/share/classes/sun/security/util/Pem.java

        String p = pem.content().replaceAll("(.{64})", "$1\r\n");
        return pemEncoded(pem.type(), p);
    }
+


Is it correct to put the 2 new methods here? Seems not closely related to PEM.

They are needed by PEM and EKPI, so this seems like the right place.

wangweij · 2025-09-12T17:51:36Z

src/java.base/share/classes/sun/security/util/Pem.java

+     * @param pair set to true for returning a KeyPair, if possible. Otherwise,
+     *             return a PrivateKey
+     * @param provider KeyFactory provider
+     */


This method is very similar to PKCS8Key::parseKey. Maybe we should combine them.

Before the code review, I intentionally split these apart. I didn't like how the code looked and that returning a DEREncodable complicated parseKey(). It made PKCS8Key much more complicated with typecasting and passing in pair.

If I redo PKCS8Key.java, this would be on the list to find a more elegant way to merge them.

wangweij · 2025-09-12T17:54:49Z

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

            // Store key material for subclasses to parse
            privKeyMaterial = val.data.getOctetString();

+            // Special check and parsing for ECDSA's SEC1v2 format


So there are 2 ways to extract public key from PKCS8. Are you going to check whether they match?

Also, can we add a test case for this format?

In this method, there is only one path for SEC1v2 requires the version to be 1, PKCS8 requires the version to be 2. The two should not intersect in this method.

It is true that a version 2 OneAsymmetricKey could contain a SEC1v2 private key encoding. At that point a KeyFactory needs to generate both keys to verify. I think that goes beyond what is necessary for what amounts to a "user error" in putting the wrong public and private key pair together.

I would like to explore redoing PKCS8Key.java as it has taken on many more tasks with encoding & decoding different algorithms. But I don't want that to be tied to a JEP, rather a bug or RFE.

wangweij · 2025-09-12T18:29:55Z

src/java.base/share/classes/sun/security/ec/ECPrivateKeyImpl.java

+                    Arrays.fill(oct, (byte) 0x0);
+                    if (seq.data.available() != 0) {
+                        DerValue derValue = seq.data.getDerValue();
+                        if (derValue.isContextSpecific((byte) 1)) {


If any of these ifs is false null is returned. Would you rather throw an IAE?

I see there could be a

parameters [0] ECDomainParameters {{ SECGCurveNames }} OPTIONAL,

Shall we skip it?

This only checks if one is available in the private key material. If there is none, null is fine.

The domain parameters are kept as part of private key SEC1v2 encoding and can be read when generating a private key with a KeyFactory. Translating the encoding could be error-prone, and maybe incompatible.

Oh, I meant if both [0] and [1] are there you can skip [0] and read [1]. Currently you just check for [1].

Oh yes, I didn't add a skip.

test/jdk/java/security/PEM/PEMData.java

test/jdk/java/security/PEM/PEMEncoderTest.java

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEM.java

seanjmullan · 2025-09-18T14:25:14Z

src/java.base/share/classes/java/security/PEM.java

+ * CERTIFICATE, CERTIFICATE REQUEST, ATTRIBUTE CERTIFICATE, X509 CRL, PKCS7, CMS,
+ * PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, or PUBLIC KEY.
+ *
+ * <p> {@code leadingData} may be null if no non-PEM data preceded PEM header


Suggest rewording as "... if there was no data preceding the PEM header ..."

Why do you allow null when there is a ctor that does not have a leadingData parameter - is there a reason for this?

I thought it was more friendly to specify a constructor when leadingData was known to be not needed. The other constructor is used by PEMDecoder decoding is not known until decoding the stream occurs.

src/java.base/share/classes/java/security/PEM.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/java/security/PEM.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/java/security/PEM.java

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/java/security/PEMDecoder.java

seanjmullan · 2025-10-15T12:49:05Z

src/java.base/share/classes/java/security/PEMDecoder.java

     * @param tClass the returned object class that implements
     *   {@code DEREncodable}.
     * @return a {@code DEREncodable} typecast to {@code tClass}
     * @throws IOException on IO or PEM syntax error where the


You mean they are recoverable? Otherwise it should probably be an IAE.

seanjmullan · 2025-10-15T12:56:04Z

src/java.base/share/classes/java/security/PEMDecoder.java

     * @throws IllegalArgumentException on error in decoding
-     * @throws ClassCastException if {@code tClass} is invalid for the PEM type
-     * @throws NullPointerException when any input values are null
+     * @throws ClassCastException if {@code tClass} does not represent the PEM type


It's a little odd this throws a ClassCastException. This seems more like an IllegalArgumentException to me because you are passing in the wrong type.

@wangweij pushed for CCE instead of IAE. It is a valid argument, but cannot be cast to that object. I think one can make a case for both exception types, but CCE was a bit stronger.

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

test/jdk/java/security/PEM/PEMData.java

seanjmullan · 2025-10-21T15:08:19Z

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

            throw new IOException(e);
        }
+        byte[] result = pkcs8Key.generateEncoding().clone();
+        pkcs8Key.clear();


Put this in a finally block so it gets cleared even if generateEncoding throws an exception. You should also clear the return value of generateEncoding (before you clone it). Although I don't think you need the clone, since generateEncoding returns a new array each time.

Unfortunately generateEncoding also assigned the result to the internal field encodedKey.

@wangweij is correct, generateEncoding() is setting the instance variable encodedKey. A finally-block is likely necessary if an exception happens after privateKeyMaterial is set in generateEncoding()

Ok, that could be fixed by creating another method that just does the encoding (and change generateEncoding to call that), but maybe we can fix that later.

There are generic changes to PKCS8Key outside of PEM that I'd like to do, I can look at it then.

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEM.java

src/java.base/share/classes/java/security/PEMEncoder.java

seanjmullan · 2025-10-22T18:15:16Z

src/java.base/share/classes/java/security/PEMEncoder.java

+     *                 stored in the new instance.
     * @return a new {@code PEMEncoder} instance configured for encryption
     * @throws NullPointerException when password is {@code null}
+     * @throws ProviderException if generating the encryption key fails.


This actually throws an IllegalArgumentException if the key derivation fails.

Yes, I wrote the javadoc based on a suggestion, then didn't update when the constructor was changed.

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

wangweij

Very minor comments.

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

wangweij

Some tiny comments.

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/sun/security/util/Pem.java

koushikthirupattur

LGTM!

ascarpino added 3 commits July 1, 2025 11:11

Rename PEMRecord to PEM

4ecddcb

Merge branch 'master' into pem26

9603f75

Initial

cdda7f1

openjdk bot added the security security-dev@openjdk.org label Sep 8, 2025

ascarpino added 6 commits September 8, 2025 11:33

Merge branch 'master' into pem26

0e3d6bd

doc and code updates

fd56e8e

Merge branch 'master' into pem26

73c3963

doc and code updates

b3e0200

simplify

7ffe6ad

fix test

c493fa0

ascarpino changed the title ~~Enhancement - null JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

ascarpino changed the title ~~JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implementation of PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

ascarpino changed the title ~~8360564: Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implement JEP XXX: PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

openjdk bot added the csr Pull request needs approved CSR before integration label Sep 11, 2025

ascarpino changed the title ~~8360564: Implement JEP XXX: PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) Sep 11, 2025

ascarpino marked this pull request as ready for review September 11, 2025 16:52

openjdk bot added the rfr Pull request is ready for review label Sep 11, 2025

wangweij reviewed Sep 12, 2025

View reviewed changes

rework test & commented out code.

b2d0def

seanjmullan reviewed Sep 17, 2025

View reviewed changes

seanjmullan reviewed Sep 18, 2025

View reviewed changes

ascarpino added 2 commits September 24, 2025 21:25

Merge branch 'master' into pem26

b425fb9

review comments and bug fixes

24be35c

koushikthirupattur reviewed Oct 14, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEM.java Outdated Show resolved Hide resolved

koushikthirupattur reviewed Oct 14, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMDecoder.java Outdated Show resolved Hide resolved

koushikthirupattur reviewed Oct 14, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMDecoder.java Outdated Show resolved Hide resolved

koushikthirupattur reviewed Oct 14, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMEncoder.java Show resolved Hide resolved

seanjmullan reviewed Oct 14, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMEncoder.java Outdated Show resolved Hide resolved

src/java.base/share/classes/java/security/PEMEncoder.java Outdated Show resolved Hide resolved

src/java.base/share/classes/java/security/PEMEncoder.java Outdated Show resolved Hide resolved

seanjmullan reviewed Oct 15, 2025

View reviewed changes

ascarpino added 2 commits October 20, 2025 09:52

doc updates, zeroing, fix unencrypted keypair encoding, exception mods

27d4fe4

fix non-pbe

2e9332b

seanjmullan reviewed Oct 21, 2025

View reviewed changes

wangweij reviewed Oct 21, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMDecoder.java Outdated Show resolved Hide resolved

seanjmullan reviewed Oct 22, 2025

View reviewed changes

more doc updates and zeroing

45f30dd

wangweij reviewed Oct 23, 2025

View reviewed changes

ascarpino added 2 commits October 23, 2025 17:58

docs

682bfa1

EKPI has a lot of @link's

e08d062

wangweij reviewed Oct 24, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

more docs, remove runtimeexception

4bf48dd

wangweij reviewed Oct 25, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

ascarpino added 2 commits October 30, 2025 10:08

minor doc updates, fix some bugs, PEM set to 26

e1405c0

Merge branch 'master' into pem26

563363f

wangweij reviewed Oct 30, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMEncoder.java Outdated Show resolved Hide resolved

src/java.base/share/classes/sun/security/util/Pem.java Outdated Show resolved Hide resolved

mistakes

0d95043

koushikthirupattur approved these changes Nov 3, 2025

View reviewed changes

wangweij approved these changes Nov 3, 2025

View reviewed changes

8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

Are you sure you want to change the base?

8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

Conversation

ascarpino commented Sep 8, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewers without OpenJDK IDs

Reviewing

Uh oh!

bridgekeeper bot commented Sep 8, 2025

Uh oh!

openjdk bot commented Sep 8, 2025

Uh oh!

openjdk bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ascarpino commented Sep 11, 2025

Uh oh!

openjdk bot commented Sep 11, 2025

Uh oh!

mlbridge bot commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

wangweij left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wangweij Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wangweij Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ascarpino commented Sep 8, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Sep 8, 2025 •

edited

Loading

mlbridge bot commented Sep 11, 2025 •

edited

Loading

wangweij Sep 12, 2025 •

edited

Loading

wangweij Sep 12, 2025 •

edited

Loading

seanjmullan Oct 21, 2025 •

edited

Loading