jdk-sandbox: comparison jdk/src/java.base/share/conf/security/java.security

equal deleted inserted replaced

-:69a809ef2aa4
+:ccaac80108c5
 # for certification path building and validation.  For example, "MD2" is
 # generally no longer considered to be a secure hash algorithm.  This section
 # describes the mechanism for disabling algorithms based on algorithm name
 # and/or key length.  This includes algorithms used in certificates, as well
 # as revocation information such as CRLs and signed OCSP Responses.
-#
+# The syntax of the disabled algorithm string is described as follows:
-# The syntax of the disabled algorithm string is described as this Java
-# BNF-style:
 #   DisabledAlgorithms:
 #       " DisabledAlgorithm { , DisabledAlgorithm } "
 #
 #   DisabledAlgorithm:
 #       AlgorithmName [Constraint] { '&' Constraint }
 #
 #   AlgorithmName:
 #       (see below)
 #
 #   Constraint:
-#       KeySizeConstraint, CertConstraint
+#       KeySizeConstraint | CAConstraint | DenyAfterConstraint
 #
 #   KeySizeConstraint:
-#       keySize Operator DecimalInteger
+#       keySize Operator KeyLength
 #
 #   Operator:
 #       <= | < | == | != | >= | >
 #
-#   DecimalInteger:
+#   KeyLength:
-#       DecimalDigits
+#       Integer value of the algorithm's key length in bits
 #
-#   DecimalDigits:
+#   CAConstraint:
-#       DecimalDigit {DecimalDigit}
-#
-#   DecimalDigit: one of
-#       1 2 3 4 5 6 7 8 9 0
-#
-#   CertConstraint
 #       jdkCA
+#
+#   DenyAfterConstraint:
+#       denyAfter YYYY-MM-DD
 #
 # The "AlgorithmName" is the standard algorithm name of the disabled
 # algorithm. See "Java Cryptography Architecture Standard Algorithm Name
 # Documentation" for information about Standard Algorithm Names.  Matching
 # is performed using a case-insensitive sub-element matching rule.  (For
 # rejected during certification path building and validation.  For example,
 # the assertion algorithm name "DSA" will disable all certificate algorithms
 # that rely on DSA, such as NONEwithDSA, SHA1withDSA.  However, the assertion
 # will not disable algorithms related to "ECDSA".
 #
-# A "Constraint" provides further guidance for the algorithm being specified.
+# A "Constraint" defines restrictions on the keys and/or certificates for
-# The "KeySizeConstraint" requires a key of a valid size range if the
+# a specified AlgorithmName:
-# "AlgorithmName" is of a key algorithm.  The "DecimalInteger" indicates the
+#
-# key size specified in number of bits.  For example, "RSA keySize <= 1024"
+#   KeySizeConstraint:
-# indicates that any RSA key with key size less than or equal to 1024 bits
+#     keySize Operator KeyLength
-# should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates
+#       The constraint requires a key of a valid size range if the
-# that any RSA key with key size less than 1024 or greater than 2048 should
+#       "AlgorithmName" is of a key algorithm.  The "KeyLength" indicates
-# be disabled. Note that the "KeySizeConstraint" only makes sense to key
+#       the key size specified in number of bits.  For example,
-# algorithms.
+#       "RSA keySize <= 1024" indicates that any RSA key with key size less
-#
+#       than or equal to 1024 bits should be disabled, and
-# "CertConstraint" specifies additional constraints for
+#       "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key
-# certificates that contain algorithms that are restricted:
+#       with key size less than 1024 or greater than 2048 should be disabled.
-#
+#       This constraint is only used on algorithms that have a key size.
-#   "jdkCA" prohibits the specified algorithm only if the algorithm is used
+#
-#     in a certificate chain that terminates at a marked trust anchor in the
+#   CAConstraint:
-#     lib/security/cacerts keystore.  All other chains are not affected.
+#     jdkCA
-#     If the jdkCA constraint is not set, then all chains using the
+#       This constraint prohibits the specified algorithm only if the
-#     specified algorithm are restricted.  jdkCA may only be used once in
+#       algorithm is used in a certificate chain that terminates at a marked
-#     a DisabledAlgorithm expression.
+#       trust anchor in the lib/security/cacerts keystore.  If the jdkCA
-#     Example:  To apply this constraint to SHA-1 certificates, include
+#       constraint is not set, then all chains using the specified algorithm
-#     the following:  "SHA1 jdkCA"
+#       are restricted.  jdkCA may only be used once in a DisabledAlgorithm
+#       expression.
+#       Example:  To apply this constraint to SHA-1 certificates, include
+#       the following:  "SHA1 jdkCA"
+#
+#   DenyAfterConstraint:
+#     denyAfter YYYY-MM-DD
+#       This constraint prohibits a certificate with the specified algorithm
+#       from being used after the date regardless of the certificate's
+#       validity.  JAR files that are signed and timestamped before the
+#       constraint date with certificates containing the disabled algorithm
+#       will not be restricted.  The date is processed in the UTC timezone.
+#       This constraint can only be used once in a DisabledAlgorithm
+#       expression.
+#       Example:  To deny usage of RSA 2048 bit certificates after Feb 3 2020,
+#       use the following:  "RSA keySize == 2048 & denyAfter 2020-02-03"
 #
 # When an algorithm must satisfy more than one constraint, it must be
 # delimited by an ampersand '&'.  For example, to restrict certificates in a
 # chain that terminate at a distribution provided trust anchor and contain
 # RSA keys that are less than or equal to 1024 bits, add the following

changeset 38576	ccaac80108c5
parent 38435	292ad46c1bf1
child 38948	a41d2f668f49