Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java

Author: dghgit

pg/src/main/java/org/bouncycastle/openpgp/PGPSessionKey.java

@@ -3,10 +3,13 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.encoders.Hex;
 
 public class PGPSessionKey
 {
+    private static final Pattern ASCII_ENCODING_PATTERN = Pattern.compile("(\\d{1,3}):([0-9A-Fa-f]+)");
+
     private final int algorithm;
     private final byte[] sessionKey;
 
@@ -23,22 +26,20 @@ public int getAlgorithm()
 
     public byte[] getKey()
     {
-        byte[] copy = new byte[sessionKey.length];
-        System.arraycopy(sessionKey, 0, copy, 0, sessionKey.length);
-        return copy;
+        return Arrays.clone(sessionKey);
     }
 
-    @SuppressWarnings("ArrayToString")
     public String toString()
     {
-        // mote: we only print the reference to sessionKey to prevent accidental disclosure of the actual key value.
-        return algorithm + ":" + sessionKey;
+        // NOTE: Avoid disclosing the sessionKey value.
+        String sessionKeyHashCode = Integer.toHexString(System.identityHashCode(sessionKey));
+
+        return algorithm + ":" + sessionKey.getClass().getName() + "@" + sessionKeyHashCode;
     }
 
     public static PGPSessionKey fromAsciiRepresentation(String ascii)
     {
-        Pattern pattern = Pattern.compile("(\\d{1,3}):([0-9A-Fa-f]+)");
-        Matcher matcher = pattern.matcher(ascii);
+        Matcher matcher = ASCII_ENCODING_PATTERN.matcher(ascii);
         if (!matcher.matches())
         {
             throw new IllegalArgumentException("Provided ascii encoding does not match expected format <algo-num>:<hex-key>");

pg/src/test/java/org/bouncycastle/openpgp/test/PGPSessionKeyTest.java

@@ -88,9 +88,9 @@ public class PGPSessionKeyTest
     public static void main(String[] args)
         throws Exception
     {
-        PGPSessionKeyTest test = new PGPSessionKeyTest();
         Security.addProvider(new BouncyCastleProvider());
-        test.performTest();
+
+        runTest(new PGPSessionKeyTest());
     }
 
     public String getName()

tls/src/main/java/org/bouncycastle/jsse/provider/ProvSSLContextSpi.java

@@ -342,9 +342,11 @@ private static Map<String, ProtocolVersion> createSupportedProtocolMapFips(
     }
 
     private static String[] getDefaultEnabledCipherSuites(Map<String, CipherSuiteInfo> supportedCipherSuiteMap,
-        List<String> defaultCipherSuiteList, boolean disableDHDefaultSuites, String cipherSuitesPropertyName)
+        List<String> defaultCipherSuiteList, boolean disableDHDefaultSuites, String cipherSuitesPropertyName,
+        String title)
     {
         List<String> candidates = getJdkTlsCipherSuites(cipherSuitesPropertyName, defaultCipherSuiteList);
+        boolean disableDHSuites = disableDHDefaultSuites && candidates == defaultCipherSuiteList;
 
         String[] result = new String[candidates.size()];
         int count = 0;
@@ -355,15 +357,15 @@ private static String[] getDefaultEnabledCipherSuites(Map<String, CipherSuiteInf
             {
                 continue;
             }
-            if (disableDHDefaultSuites &&
-                candidates == defaultCipherSuiteList &&
-                TlsDHUtils.isDHCipherSuite(cipherSuiteInfo.getCipherSuite()))
+            if (disableDHSuites && TlsDHUtils.isDHCipherSuite(cipherSuiteInfo.getCipherSuite()))
             {
+                LOG.finer(title + " default cipher suite disabled per DH disabling: " + candidate);
                 continue;
             }
             if (!ProvAlgorithmConstraints.DEFAULT.permits(JsseUtils.KEY_AGREEMENT_CRYPTO_PRIMITIVES_BC, candidate,
                 null))
             {
+                LOG.fine(title + " default cipher suite disabled by AlgorithmConstraints: " + candidate);
                 continue;
             }
 
@@ -379,7 +381,7 @@ private static String[] getDefaultEnabledCipherSuitesClient(Map<String, CipherSu
             .getBooleanSystemProperty("org.bouncycastle.jsse.client.dh.disableDefaultSuites", false);
 
         return getDefaultEnabledCipherSuites(supportedCipherSuiteMap, defaultCipherSuiteList, disableDHDefaultSuites,
-            PROPERTY_CLIENT_CIPHERSUITES);
+            PROPERTY_CLIENT_CIPHERSUITES, "Client");
     }
 
     private static String[] getDefaultEnabledCipherSuitesServer(Map<String, CipherSuiteInfo> supportedCipherSuiteMap,
@@ -389,7 +391,7 @@ private static String[] getDefaultEnabledCipherSuitesServer(Map<String, CipherSu
             .getBooleanSystemProperty("org.bouncycastle.jsse.server.dh.disableDefaultSuites", false);
 
         return getDefaultEnabledCipherSuites(supportedCipherSuiteMap, defaultCipherSuiteList, disableDHDefaultSuites,
-            PROPERTY_SERVER_CIPHERSUITES);
+            PROPERTY_SERVER_CIPHERSUITES, "Server");
     }
 
     private static String[] getDefaultEnabledProtocols(Map<String, ProtocolVersion> supportedProtocolMap,