You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Stefan Seelmann <ma...@stefan-seelmann.de> on 2016/02/22 10:14:36 UTC
[ApacheDS] Test failures with latest JDK
Hi,
after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
disabled[1].
I think we just need to change the algorithms used when generating the
certificates, but I don't find the place in the code where that can be
done. Any pointers?
Thanks,
Stefan
[1] http://www.oracle.com/technetwork/java/javase/8u71-relnotes-2773756.html
Re: [ApacheDS] Test failures with latest JDK
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/22/2016 10:57 AM, Stefan Seelmann wrote:
> On 02/22/2016 10:54 AM, Emmanuel Lécharny wrote:
>> We can't really, unless we fix a pb in Studio.
>>
>> Colm tried to upgrade bcprov to the latest version, and it makes the
>> studio build to fail.
>
> I think we can fix that with upgrade from Luna to Mars. I'll try to work
> on that (DIRSTUDIO-1093).
Upgrade to Mars.1 was easy, and ApacheDS with latest bouncycastle 1.54
works fine :)
Re: [ApacheDS] Test failures with latest JDK
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/22/2016 10:54 AM, Emmanuel Lécharny wrote:
> We can't really, unless we fix a pb in Studio.
>
> Colm tried to upgrade bcprov to the latest version, and it makes the
> studio build to fail.
I think we can fix that with upgrade from Luna to Mars. I'll try to work
on that (DIRSTUDIO-1093).
Re: [ApacheDS] Test failures with latest JDK
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 22/02/16 10:29, Kiran Ayyagari a écrit :
> On Mon, Feb 22, 2016 at 2:44 PM, Stefan Seelmann <ma...@stefan-seelmann.de>
> wrote:
>
>> Hi,
>>
>> after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
>> server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
>> disabled[1].
>>
>> I think we just need to change the algorithms used when generating the
>> certificates, but I don't find the place in the code where that can be
>> done. Any pointers?
>>
> the only class which we use for generating the default certificate is
> TlsKeyGenerator.java
> but I think we must upgrade to a new version of bouncycastle cause
> certificate is
> generated using this library.
We can't really, unless we fix a pb in Studio.
Colm tried to upgrade bcprov to the latest version, and it makes the
studio build to fail.
Otherwise, I would *strongly* suggest we deprecated MD5. It's broken, it
has been deprecated by Oracle, and should be deprecated everywhere,
final : " The CMU Software Engineering Institute
<https://en.wikipedia.org/wiki/CMU_Software_Engineering_Institute>
considers MD5 essentially "cryptographically broken and unsuitable for
further use"."
Those using MD5 have to switch to something that is solid, or move to
plain text instead. All in all, it's pretty much the same thing...
Re: [ApacheDS] Test failures with latest JDK
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/24/2016 10:14 AM, Emmanuel L�charny wrote:
> Le 24/02/16 09:23, Stefan Seelmann a �crit :
>> On 02/22/2016 10:29 AM, Kiran Ayyagari wrote:
>>> On Mon, Feb 22, 2016 at 2:44 PM, Stefan Seelmann <ma...@stefan-seelmann.de>
>>> wrote:
>>>
>>>> Hi,
>>>>
>>>> after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
>>>> server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
>>>> disabled[1].
>>>>
>>>> I think we just need to change the algorithms used when generating the
>>>> certificates, but I don't find the place in the code where that can be
>>>> done. Any pointers?
>>>>
>>> the only class which we use for generating the default certificate is
>>> TlsKeyGenerator.java
>> Thanks Kiran for the pointer.
>>
>> It turned out the reason is not MD5 (we use SHA1), but the key size. In
>> TlsKeyGenerator the KEY_SIZE is set to 512, if I icrease to 1024 the
>> tests pass.
>>
>> Would be an easy fix, however there is a comment above KEY_SIZE:
>>
>> ... however note to pass export restrictions we must use a key
>> size of* 512 or less here as the default ...
>> ... This is required to classify ApacheDS in the ECCN 5D002
>> category. Please see the following page for more information:
>> http://www.apache.org/dev/crypto.html ...
>>
>> That page still states 512 bits, but also includes a note that the law
>> was changes in 2010, but it seems ASF Legal didn't update the page.
>>
>> So are we still bound to the 512 bits restriction? Or can we just change
>> it to 1024 (or even higher)? Or should we just ask Legal?
>
> I'll check the page. I remember having had to deal with the ECCN
> declaration for Directory 10 years ago (sort of), and it was a kind of a
> pain, but a necessary one.
As I understand the page the 512 bits restriction it still true.
What I now did is to use 1024 bit *only* for tests in FrameworkRunner
class [1]. The key generated as server startup still has 512 bit.
Kind Regards,
Stefan
[1] http://svn.apache.org/viewvc?rev=1749199&view=rev
Re: [ApacheDS] Test failures with latest JDK
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 24/02/16 09:23, Stefan Seelmann a écrit :
> On 02/22/2016 10:29 AM, Kiran Ayyagari wrote:
>> On Mon, Feb 22, 2016 at 2:44 PM, Stefan Seelmann <ma...@stefan-seelmann.de>
>> wrote:
>>
>>> Hi,
>>>
>>> after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
>>> server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
>>> disabled[1].
>>>
>>> I think we just need to change the algorithms used when generating the
>>> certificates, but I don't find the place in the code where that can be
>>> done. Any pointers?
>>>
>> the only class which we use for generating the default certificate is
>> TlsKeyGenerator.java
> Thanks Kiran for the pointer.
>
> It turned out the reason is not MD5 (we use SHA1), but the key size. In
> TlsKeyGenerator the KEY_SIZE is set to 512, if I icrease to 1024 the
> tests pass.
>
> Would be an easy fix, however there is a comment above KEY_SIZE:
>
> ... however note to pass export restrictions we must use a key
> size of* 512 or less here as the default ...
> ... This is required to classify ApacheDS in the ECCN 5D002
> category. Please see the following page for more information:
> http://www.apache.org/dev/crypto.html ...
>
> That page still states 512 bits, but also includes a note that the law
> was changes in 2010, but it seems ASF Legal didn't update the page.
>
> So are we still bound to the 512 bits restriction? Or can we just change
> it to 1024 (or even higher)? Or should we just ask Legal?
I'll check the page. I remember having had to deal with the ECCN
declaration for Directory 10 years ago (sort of), and it was a kind of a
pain, but a necessary one.
I'll keep you posted.
Re: [ApacheDS] Test failures with latest JDK
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/22/2016 10:29 AM, Kiran Ayyagari wrote:
> On Mon, Feb 22, 2016 at 2:44 PM, Stefan Seelmann <ma...@stefan-seelmann.de>
> wrote:
>
>> Hi,
>>
>> after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
>> server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
>> disabled[1].
>>
>> I think we just need to change the algorithms used when generating the
>> certificates, but I don't find the place in the code where that can be
>> done. Any pointers?
>>
> the only class which we use for generating the default certificate is
> TlsKeyGenerator.java
Thanks Kiran for the pointer.
It turned out the reason is not MD5 (we use SHA1), but the key size. In
TlsKeyGenerator the KEY_SIZE is set to 512, if I icrease to 1024 the
tests pass.
Would be an easy fix, however there is a comment above KEY_SIZE:
... however note to pass export restrictions we must use a key
size of* 512 or less here as the default ...
... This is required to classify ApacheDS in the ECCN 5D002
category. Please see the following page for more information:
http://www.apache.org/dev/crypto.html ...
That page still states 512 bits, but also includes a note that the law
was changes in 2010, but it seems ASF Legal didn't update the page.
So are we still bound to the 512 bits restriction? Or can we just change
it to 1024 (or even higher)? Or should we just ask Legal?
Kind Regards,
Stefan
Re: [ApacheDS] Test failures with latest JDK
Posted by Kiran Ayyagari <ka...@apache.org>.
On Mon, Feb 22, 2016 at 2:44 PM, Stefan Seelmann <ma...@stefan-seelmann.de>
wrote:
> Hi,
>
> after update to latest JDK (1.8.0_74, 1.7.0_95) some tests in
> server-integ fail. I think the cause is that since 1.8.0_71 MD5 is
> disabled[1].
>
> I think we just need to change the algorithms used when generating the
> certificates, but I don't find the place in the code where that can be
> done. Any pointers?
>
the only class which we use for generating the default certificate is
TlsKeyGenerator.java
but I think we must upgrade to a new version of bouncycastle cause
certificate is
generated using this library.
>
> Thanks,
> Stefan
>
> [1]
> http://www.oracle.com/technetwork/java/javase/8u71-relnotes-2773756.html
>
Kiran