You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by tv...@apache.org on 2021/12/31 09:44:24 UTC
[commons-jcs] branch release-3.1 updated (57a16b6 -> e19e4e4)
This is an automated email from the ASF dual-hosted git repository.
tv pushed a change to branch release-3.1
in repository https://gitbox.apache.org/repos/asf/commons-jcs.git.
from 57a16b6 [maven-release-plugin] prepare for next development iteration
add d31a5a8 Bump log4j-core from 2.16.0 to 2.17.1
add c622ab3 Merge pull request #81 from apache/dependabot/maven/org.apache.logging.log4j-log4j-core-2.17.1
add f062298 Bump log4j-core from 2.16.0 to 2.17.1 #81.
add 7fdbc1c Run dependabot once a week.
add c5ef4a8 Bump log4j-api from 2.17.0 to 2.17.1
add b806ff3 Merge pull request #82 from apache/dependabot/maven/org.apache.logging.log4j-log4j-api-2.17.1
new ff4ebf2 Merge remote-tracking branch 'origin/master' into release-3.1
new ab5ac9a Use new SecureRandom() instead of SecureRandom.getStrongInstance() to
new e19e4e4 Document changes
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/dependabot.yml | 6 +++--
commons-jcs-core/pom.xml | 4 ++--
.../utils/serialization/EncryptingSerializer.java | 27 ++++++++++++++++------
src/changes/changes.xml | 8 +++++--
4 files changed, 32 insertions(+), 13 deletions(-)
[commons-jcs] 03/03: Document changes
Posted by tv...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
tv pushed a commit to branch release-3.1
in repository https://gitbox.apache.org/repos/asf/commons-jcs.git
commit e19e4e4b6c90ce5fd4e1ed192634178c4b2609e1
Author: Thomas Vandahl <tv...@apache.org>
AuthorDate: Fri Dec 31 10:43:05 2021 +0100
Document changes
---
src/changes/changes.xml | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index f0d8f8a..689dd3d 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -19,7 +19,11 @@
<author email="dev@commons.apache.org">Apache Commons Developers</author>
</properties>
<body>
- <release version="3.1" date="2021-12-23">
+ <release version="3.1" date="2022-01-02">
+ <action dev="tv" type="fix" due-to="Bruno Kinoshita">
+ Use new SecureRandom() instead of SecureRandom.getStrongInstance() to
+ avoid potential performance problems on Linux
+ </action>
<action dev="tv" type="fix" due-to="Patrick Ziegler" issue="JCS-228">
Attempt to fix osgi import packages
</action>
[commons-jcs] 02/03: Use new SecureRandom() instead of SecureRandom.getStrongInstance() to
Posted by tv...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
tv pushed a commit to branch release-3.1
in repository https://gitbox.apache.org/repos/asf/commons-jcs.git
commit ab5ac9a5f1f752731e503e33072874319eb6eb35
Author: Thomas Vandahl <tv...@apache.org>
AuthorDate: Fri Dec 31 10:40:38 2021 +0100
Use new SecureRandom() instead of SecureRandom.getStrongInstance() to
avoid performance problems on Linux
---
.../utils/serialization/EncryptingSerializer.java | 27 ++++++++++++++++------
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/commons-jcs-core/src/main/java/org/apache/commons/jcs3/utils/serialization/EncryptingSerializer.java b/commons-jcs-core/src/main/java/org/apache/commons/jcs3/utils/serialization/EncryptingSerializer.java
index 3137bb5..bbe9b8d 100644
--- a/commons-jcs-core/src/main/java/org/apache/commons/jcs3/utils/serialization/EncryptingSerializer.java
+++ b/commons-jcs-core/src/main/java/org/apache/commons/jcs3/utils/serialization/EncryptingSerializer.java
@@ -21,11 +21,16 @@ package org.apache.commons.jcs3.utils.serialization;
import java.io.IOException;
import java.nio.ByteBuffer;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
+import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.GCMParameterSpec;
@@ -42,7 +47,10 @@ import org.apache.commons.jcs3.engine.behavior.IElementSerializer;
*/
public class EncryptingSerializer extends StandardSerializer
{
+ private static final String DEFAULT_SECRET_KEY_ALGORITHM = "PBKDF2WithHmacSHA256";
private static final String DEFAULT_CIPHER = "AES/ECB/PKCS5Padding";
+ private static final int KEYHASH_ITERATION_COUNT = 1000;
+ private static final int KEY_LENGTH = 256;
private static final int TAG_LENGTH = 128;
private static final int IV_LENGTH = 12;
private static final int SALT_LENGTH = 16;
@@ -82,8 +90,8 @@ public class EncryptingSerializer extends StandardSerializer
try
{
- this.secureRandom = SecureRandom.getInstanceStrong();
- this.secretKeyFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
+ this.secureRandom = new SecureRandom();
+ this.secretKeyFactory = SecretKeyFactory.getInstance(DEFAULT_SECRET_KEY_ALGORITHM);
}
catch (NoSuchAlgorithmException e)
{
@@ -112,7 +120,7 @@ public class EncryptingSerializer extends StandardSerializer
this.cipherTransformation = transformation;
}
- private byte[] getRandomBytes(int length) throws NoSuchAlgorithmException
+ private byte[] getRandomBytes(int length)
{
byte[] bytes = new byte[length];
secureRandom.nextBytes(bytes);
@@ -120,10 +128,11 @@ public class EncryptingSerializer extends StandardSerializer
return bytes;
}
- private SecretKey createSecretKey(String password, byte[] salt) throws NoSuchAlgorithmException, InvalidKeySpecException
+ private SecretKey createSecretKey(String password, byte[] salt) throws InvalidKeySpecException
{
/* Derive the key, given password and salt. */
- PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 1000, 256);
+ PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt,
+ KEYHASH_ITERATION_COUNT, KEY_LENGTH);
SecretKey tmp = secretKeyFactory.generateSecret(spec);
return new SecretKeySpec(tmp.getEncoded(), "AES");
}
@@ -155,7 +164,9 @@ public class EncryptingSerializer extends StandardSerializer
.put(encrypted)
.array();
}
- catch (Exception e)
+ catch (NoSuchAlgorithmException | NoSuchPaddingException | BadPaddingException |
+ IllegalBlockSizeException | InvalidKeyException | InvalidKeySpecException |
+ InvalidAlgorithmParameterException e)
{
throw new IOException("Error while encrypting", e);
}
@@ -191,7 +202,9 @@ public class EncryptingSerializer extends StandardSerializer
return cipher.doFinal(encrypted);
}
- catch (Exception e)
+ catch (NoSuchAlgorithmException | NoSuchPaddingException | BadPaddingException |
+ IllegalBlockSizeException | InvalidKeyException | InvalidKeySpecException |
+ InvalidAlgorithmParameterException e)
{
throw new IOException("Error while decrypting", e);
}
[commons-jcs] 01/03: Merge remote-tracking branch 'origin/master' into release-3.1
Posted by tv...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
tv pushed a commit to branch release-3.1
in repository https://gitbox.apache.org/repos/asf/commons-jcs.git
commit ff4ebf287d2b2d93fe696d5756db91048e30a3b7
Merge: 57a16b6 b806ff3
Author: Thomas Vandahl <tv...@apache.org>
AuthorDate: Fri Dec 31 10:32:23 2021 +0100
Merge remote-tracking branch 'origin/master' into release-3.1
.github/dependabot.yml | 6 ++++--
commons-jcs-core/pom.xml | 4 ++--
src/changes/changes.xml | 2 +-
3 files changed, 7 insertions(+), 5 deletions(-)