Re: [Curdle] AlgorithmIdentifier parameters in draft-ietf-curdle-pkix-03

[Ilari Liusvaara <[e-mail]>]

On Sun, Feb 19, 2017 at 05:25:59PM +0000, str4d wrote:
> On 02/19/2017 11:27 AM, Ilari Liusvaara wrote:
> > On Sat, Feb 18, 2017 at 01:15:18PM +0000, str4d wrote:
> >> Hi all,
> >>
> >> The problem is that the Sun AlgorithmId class always adds a NULL when
> >> encoding if there are no parameters, for compatibility with Solaris [4].
> >> So AFAICT it is presently impossible for me to write an implementation
> >> that simultaneously:
> >>
> >> - follows draft-ietf-curdle-pkix-03 correctly
> >> - can retrieve EdDSA keys from a default Java keystore
> >>
> >> Is anyone in the WG aware of a workaround for this, or have links to
> >> past WG discussion on this point? I would think that Oracle should at
> >> least be made aware of this issue, but even if they changes this in Java
> >> 10, that doesn't help my implementation run on earlier Java versions.
> >> The only alternatives I see at this point are:
> > 
> > AlgorithmId.encodeAbsentParametersAsNull(boolean)?
> > 
> > (The first javadoc for AlgorithmId I found has that method).
> > 
> > 
> > -Ilari
> > 
> 
> If I'm looking at the same JavaDoc as you [0], that method is for
> iaik.asn1.structures.AlgorithmID, which is part of the proprietary
> IAIK-JCE Provider. I am referring to sun.security.x509.AlgorithmId from
> the Sun Provider bundled with Oracle Java, which does not have this method.

Ah, I found what I presume is code for the correct class.

The problematic method (derEncode) looks like it can take an override
from subclass.

 

-Ilari