8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

ascarpino · 2025-09-08T15:42:13Z

Hi

Please review the Second Preview for the PEM API. The most significant changes from JEP 470 are:

Renamed the name of PEMRecord class to PEM.
Revised the new encryptKey methods of the EncryptedPrivateKeyInfo class to accept DEREncodable objects rather than just PrivateKey objects so that cryptographic objects with public keys, i.e., KeyPair and PKCS8EncodedKeySpec, can also be encrypted.
Enhanced the PEMEncoder and PEMDecoder classes to support the encryption and decryption of KeyPair and PKCS8EncodedKeySpec objects.

thanks

Tony

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change requires CSR request JDK-8367431 to be approved
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issues

JDK-8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) (Enhancement - P4)
JDK-8367431: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) (CSR)

Reviewers

Weijun Wang (@wangweij - Reviewer)
Sean Mullan (@seanjmullan - Reviewer) Review applies to 0d95043c

Reviewers without OpenJDK IDs

@koushikthirupattur (no known openjdk.org user name / role) Review applies to 0d95043c

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/27147/head:pull/27147
$ git checkout pull/27147

Update a local copy of the PR:
$ git checkout pull/27147
$ git pull https://git.openjdk.org/jdk.git pull/27147/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 27147

View PR using the GUI difftool:
$ git pr show -t 27147

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/27147.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-09-08T15:43:23Z

👋 Welcome back ascarpino! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-09-08T15:44:08Z

@ascarpino This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview)

Reviewed-by: weijun, mullan

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 98 new commits pushed to the master branch:

cc05530: 8371732: [redo] Change java.time month/day field types to 'byte'
91b97a4: 8371922: Remove unused NonblockingQueue class
3924a28: 8371083: FollowReferences reports non-class objects as JVMTI_HEAP_REFERENCE_SYSTEM_CLASS
... and 95 more: https://git.openjdk.org/jdk/compare/c8656449c28581ae9c3d815105e338e42253bb43...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-09-08T15:44:55Z

@ascarpino The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

ascarpino · 2025-09-11T00:23:24Z

/csr

openjdk · 2025-09-11T00:24:29Z

@ascarpino has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@ascarpino please create a CSR request for issue JDK-8360564 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

mlbridge · 2025-09-11T16:58:57Z

Webrevs

wangweij

Some comments.

test/jdk/javax/crypto/EncryptedPrivateKeyInfo/GetKeyPair.java

wangweij · 2025-09-12T17:50:58Z

src/java.base/share/classes/sun/security/util/Pem.java

        String p = pem.content().replaceAll("(.{64})", "$1\r\n");
        return pemEncoded(pem.type(), p);
    }
+


Is it correct to put the 2 new methods here? Seems not closely related to PEM.

They are needed by PEM and EKPI, so this seems like the right place.

wangweij · 2025-09-12T17:51:36Z

src/java.base/share/classes/sun/security/util/Pem.java

+     * @param pair set to true for returning a KeyPair, if possible. Otherwise,
+     *             return a PrivateKey
+     * @param provider KeyFactory provider
+     */


This method is very similar to PKCS8Key::parseKey. Maybe we should combine them.

Before the code review, I intentionally split these apart. I didn't like how the code looked and that returning a DEREncodable complicated parseKey(). It made PKCS8Key much more complicated with typecasting and passing in pair.

If I redo PKCS8Key.java, this would be on the list to find a more elegant way to merge them.

wangweij · 2025-09-12T17:54:49Z

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

            // Store key material for subclasses to parse
            privKeyMaterial = val.data.getOctetString();

+            // Special check and parsing for ECDSA's SEC1v2 format


So there are 2 ways to extract public key from PKCS8. Are you going to check whether they match?

Also, can we add a test case for this format?

In this method, there is only one path for SEC1v2 requires the version to be 1, PKCS8 requires the version to be 2. The two should not intersect in this method.

It is true that a version 2 OneAsymmetricKey could contain a SEC1v2 private key encoding. At that point a KeyFactory needs to generate both keys to verify. I think that goes beyond what is necessary for what amounts to a "user error" in putting the wrong public and private key pair together.

I would like to explore redoing PKCS8Key.java as it has taken on many more tasks with encoding & decoding different algorithms. But I don't want that to be tied to a JEP, rather a bug or RFE.

wangweij · 2025-09-12T18:29:55Z

src/java.base/share/classes/sun/security/ec/ECPrivateKeyImpl.java

+                    Arrays.fill(oct, (byte) 0x0);
+                    if (seq.data.available() != 0) {
+                        DerValue derValue = seq.data.getDerValue();
+                        if (derValue.isContextSpecific((byte) 1)) {


If any of these ifs is false null is returned. Would you rather throw an IAE?

I see there could be a

parameters [0] ECDomainParameters {{ SECGCurveNames }} OPTIONAL,

Shall we skip it?

This only checks if one is available in the private key material. If there is none, null is fine.

The domain parameters are kept as part of private key SEC1v2 encoding and can be read when generating a private key with a KeyFactory. Translating the encoding could be error-prone, and maybe incompatible.

Oh, I meant if both [0] and [1] are there you can skip [0] and read [1]. Currently you just check for [1].

Oh yes, I didn't add a skip.

test/jdk/java/security/PEM/PEMData.java

test/jdk/java/security/PEM/PEMEncoderTest.java

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEM.java

seanjmullan · 2025-09-18T14:25:14Z

src/java.base/share/classes/java/security/PEM.java

+ * CERTIFICATE, CERTIFICATE REQUEST, ATTRIBUTE CERTIFICATE, X509 CRL, PKCS7, CMS,
+ * PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, or PUBLIC KEY.
+ *
+ * <p> {@code leadingData} may be null if no non-PEM data preceded PEM header


Suggest rewording as "... if there was no data preceding the PEM header ..."

Why do you allow null when there is a ctor that does not have a leadingData parameter - is there a reason for this?

I thought it was more friendly to specify a constructor when leadingData was known to be not needed. The other constructor is used by PEMDecoder decoding is not known until decoding the stream occurs.

src/java.base/share/classes/java/security/PEM.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEMEncoder.java

wangweij

Very minor comments.

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

wangweij

Some tiny comments.

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java

src/java.base/share/classes/java/security/PEMDecoder.java

src/java.base/share/classes/java/security/PEMEncoder.java

src/java.base/share/classes/sun/security/util/Pem.java

koushikthirupattur

LGTM!

myankelev · 2025-11-10T15:35:18Z

src/java.base/share/classes/java/security/PEM.java

+     * @return a decoded byte array
+     * @throws IllegalArgumentException if decoding fails
+     */
+    final public byte[] decode() {


This method doesn't seem to be covered by the tests. I have created a ticket to add this https://bugs.openjdk.org/browse/JDK-8371574.
It also covers the 2 methods in PEM.java in utils, which could be covered further

ascarpino · 2025-11-14T21:06:00Z

/integrate

openjdk · 2025-11-14T21:08:37Z

Going to push as commit ad3dfaf.
Since your change was applied there have been 98 commits pushed to the master branch:

cc05530: 8371732: [redo] Change java.time month/day field types to 'byte'
91b97a4: 8371922: Remove unused NonblockingQueue class
3924a28: 8371083: FollowReferences reports non-class objects as JVMTI_HEAP_REFERENCE_SYSTEM_CLASS
... and 95 more: https://git.openjdk.org/jdk/compare/c8656449c28581ae9c3d815105e338e42253bb43...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-11-14T21:08:50Z

@ascarpino Pushed as commit ad3dfaf.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

ascarpino added 3 commits July 1, 2025 11:11

Rename PEMRecord to PEM

4ecddcb

Merge branch 'master' into pem26

9603f75

Initial

cdda7f1

openjdk bot added the security [email protected] label Sep 8, 2025

ascarpino added 6 commits September 8, 2025 11:33

Merge branch 'master' into pem26

0e3d6bd

doc and code updates

fd56e8e

Merge branch 'master' into pem26

73c3963

doc and code updates

b3e0200

simplify

7ffe6ad

fix test

c493fa0

ascarpino changed the title ~~Enhancement - null JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

ascarpino changed the title ~~JDK-8360564 Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implementation of PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

ascarpino changed the title ~~8360564: Implementation of PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implement JEP XXX: PEM Encodings of Cryptographic Objects (Second Preview) Sep 10, 2025

openjdk bot added the csr Pull request needs approved CSR before integration label Sep 11, 2025

ascarpino changed the title ~~8360564: Implement JEP XXX: PEM Encodings of Cryptographic Objects (Second Preview)~~ 8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) Sep 11, 2025

ascarpino marked this pull request as ready for review September 11, 2025 16:52

openjdk bot added the rfr Pull request is ready for review label Sep 11, 2025

wangweij reviewed Sep 12, 2025

View reviewed changes

rework test & commented out code.

b2d0def

seanjmullan reviewed Sep 17, 2025

View reviewed changes

seanjmullan reviewed Sep 18, 2025

View reviewed changes

ascarpino added 2 commits September 24, 2025 21:25

Merge branch 'master' into pem26

b425fb9

review comments and bug fixes

24be35c

more doc updates and zeroing

45f30dd

wangweij reviewed Oct 23, 2025

View reviewed changes

ascarpino added 2 commits October 23, 2025 17:58

docs

682bfa1

EKPI has a lot of @link's

e08d062

wangweij reviewed Oct 24, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

more docs, remove runtimeexception

4bf48dd

wangweij reviewed Oct 25, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/EncryptedPrivateKeyInfo.java Outdated Show resolved Hide resolved

wangweij reviewed Oct 27, 2025

View reviewed changes

ascarpino added 2 commits October 30, 2025 10:08

minor doc updates, fix some bugs, PEM set to 26

e1405c0

Merge branch 'master' into pem26

563363f

wangweij reviewed Oct 30, 2025

View reviewed changes

src/java.base/share/classes/java/security/PEMEncoder.java Outdated Show resolved Hide resolved

src/java.base/share/classes/sun/security/util/Pem.java Outdated Show resolved Hide resolved

mistakes

0d95043

koushikthirupattur approved these changes Nov 3, 2025

View reviewed changes

wangweij approved these changes Nov 3, 2025

View reviewed changes

seanjmullan approved these changes Nov 6, 2025

View reviewed changes

ascarpino added 2 commits November 6, 2025 16:15

remove PEMRecord import

5cba4d9

Merge branch 'master' into pem26

2ee3e7a

wangweij approved these changes Nov 7, 2025

View reviewed changes

myankelev reviewed Nov 10, 2025

View reviewed changes

openjdk bot added ready Pull request is ready to be integrated and removed csr Pull request needs approved CSR before integration labels Nov 14, 2025

openjdk bot added the integrated Pull request has been integrated label Nov 14, 2025

openjdk bot closed this Nov 14, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Nov 14, 2025

8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

8360564: Implement JEP 524: PEM Encodings of Cryptographic Objects (Second Preview) #27147

Uh oh!

Conversation

ascarpino commented Sep 8, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewers without OpenJDK IDs

Reviewing

Uh oh!

bridgekeeper bot commented Sep 8, 2025

Uh oh!

openjdk bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ascarpino commented Sep 11, 2025

Uh oh!

openjdk bot commented Sep 11, 2025

Uh oh!

mlbridge bot commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

wangweij left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wangweij Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wangweij Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ascarpino commented Sep 8, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Sep 8, 2025 •

edited

Loading

openjdk bot commented Sep 8, 2025 •

edited

Loading

mlbridge bot commented Sep 11, 2025 •

edited

Loading

wangweij Sep 12, 2025 •

edited

Loading

wangweij Sep 12, 2025 •

edited

Loading