Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8044445

JEP 229: Create PKCS12 Keystores by Default

    Details

    • Author:
      Vincent Ryan
    • JEP Type:
      Feature
    • Exposure:
      Open
    • Subcomponent:
    • Scope:
      SE
    • Discussion:
      security dash dev at openjdk dot java dot net
    • Effort:
      M
    • Duration:
      M
    • Alert Status:
       Green
    • JEP Number:
      229

      Description

      Summary

      Transition the default keystore type from JKS to PKCS12.

      Goals

      • Improve security. PKCS12 offers stronger cryptographic algorithms than JKS.

      • Maintain forward and backward compatibility. Applications that access JKS and PKCS12 keystores must continue to function across JDK releases.

      Motivation

      JKS is a custom, JDK-specific keystore type. It has been the default keystore type for the Java platform since JDK 1.2. JKS keystores can only store private keys and trusted public-key certificates, and they are based on a proprietary format that is not easily extensible to new cryptographic algorithms.

      PKCS12 is an extensible, standard, and widely-supported format for storing cryptographic keys. As of JDK 8, PKCS12 keystores can store private keys, trusted public key certificates, and secret keys. Switching to PKCS12 improves keystore integrity and confidentiality. It also opens opportunities for interoperability with other systems that also support PKCS12.

      Description

      This feature changes the default keystore type from JKS to PKCS12. By default, new keystores will be created in the PKCS12 keystore format. Existing keystores will not change and keystore applications can continue to explicitly specify the keystore type they require.

      Existing applications must not be disrupted. Keystores tend to be long-lived, so we need to support access across several JDK releases. Applications that access keystores created by earlier JDK releases must run unaltered on JDK 9. Similarly, applications that access keystores created by JDK 9 should run unaltered on earlier JDK releases.

      This requirement is achieved by introducing a keystore detection mechanism that understands both the JKS and PKCS12 formats. A keystore's format is examined before it is loaded to determine its type and then the appropriate keystore implementation is used to access it. The mechanism is enabled by default but can be disabled if required.

      Support for this keystore-detection mechanism may be backported to earlier JDK releases.

      Testing

      Significant testing is required across JDK releases to ensure that compatibility is maintained for applications that access keystores.

        Issue Links

          Activity

          Hide
          iris Iris Clark added a comment -
          Added PKCS12 link to Summary. Relocated link label to Summary section.
          Show
          iris Iris Clark added a comment - Added PKCS12 link to Summary. Relocated link label to Summary section.

            People

            • Assignee:
              vinnie Vincent Ryan
              Reporter:
              vinnie Vincent Ryan
              Owner:
              Vincent Ryan
              Reviewed By:
              Brian Goetz, Sean Mullan
              Endorsed By:
              Brian Goetz
            • Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

              • Due:
                Created:
                Updated:
                Resolved:
                Integration Due: