Repository navigation
Backend: certificates, CSRs, PKCS#12, chain validation and ECDH - #6091
Merged
Merged
Conversation
com.codename1.backend.security.pki reads PEM and X.509, validates chains against explicit trust anchors (signatures, validity, basic constraints, key usage, path length, critical extensions, host name and EKU), creates and reads PKCS#10 requests, and reads and writes PKCS#12 in the PBES2/AES/HMAC profile OpenSSL 3 and current JDKs use. It is shared Java, so both runtimes run the same code. Crypto gains generateEcKey (P-256/P-384), ecdh and AES-CBC on both the JVM and the native OpenSSL arm. The algorithm profile is documented in the package and the developer guide. Fixtures come from the openssl command line. PkiTest cross-checks every result against the JDK's X.509, KeyStore, Signature and KeyAgreement, and authcheck prints the same results as VALUE lines that BackendSecurityTest requires to match between the JVM and the native binary. Fixes #5991 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Collaborator
Author
|
Compared 191 screenshots: 191 matched. Native Android coverage
✅ Native Android screenshot tests passed. Native Android coverage
Benchmark ResultsDetailed Performance Metrics
|
Collaborator
Author
|
Compared 227 screenshots: 227 matched. |
Collaborator
Author
|
Compared 206 screenshots: 206 matched. Benchmark ResultsDetailed Performance Metrics
|
Contributor
✅ Continuous Quality ReportTest & Coverage
Static Analysis
Generated automatically by the PR CI workflow. |
The padded AES-CBC API offered a padding verdict to any caller, the padding-oracle shape code scanning flags. PKCS#12 now removes its own padding only after checkMac() has accepted the file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Compared 206 screenshots: 206 matched. Benchmark ResultsDetailed Performance Metrics
ParparVM vs HotSpot (JDK 25): Windows x64Runner CPU: AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD (baseline Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in
Result: no regression |
The inline block named KeyFiles in the wrong package; compiling it caught that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Developer Guide build artifacts are available for download from this workflow run:
Developer Guide quality checks: |
Contributor
Cloudflare Preview
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A mode flag let CodeQL trace the NIST decrypt vector's fixed IV into the encrypting cipher. Two methods keep the random-IV rule on the method it governs; the test's rejected-length IV is random too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The scheduled ticker could take the ended room first and record it on its own thread, so a caller reading the match history right after fastForward found nothing yet (OnlineMatchTest on MySQL). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Compared 206 screenshots: 206 matched. ParparVM vs HotSpot (JDK 25): Linux x64Runner CPU: AMD EPYC 9V45 96-Core Processor (baseline Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in
Result: no regression |
Collaborator
Author
|
Compared 206 screenshots: 206 matched. ParparVM vs HotSpot (JDK 25): Linux arm64Runner CPU: Neoverse-N2 (baseline Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in
Result: no regression |
Collaborator
Author
|
Compared 206 screenshots: 206 matched. Benchmark ResultsDetailed Performance Metrics
ParparVM vs HotSpot (JDK 25): Windows arm64Runner CPU: ARMv8 (64-bit) Family 8 Model D49 Revision 0, MICROSOFT CORPORATION (baseline Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in
Result: no regression |
Contributor
✅ ByteCodeTranslator Quality ReportTest & Coverage
Benchmark Results
Static Analysis
Generated automatically by the PR CI workflow. |
CodeQL followed the NULL array literal through an encoded PFX into the IV decode() reads back, and flagged the decrypting Cipher.init. The Skirmish Initializr template is regenerated for the Rooms fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Compared 192 screenshots: 192 matched. Benchmark Results
Detailed Performance Metrics
ParparVM vs HotSpot (JDK 25): macOS arm64Runner CPU: Apple M1 (Virtual) (baseline Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in
Result: no regression |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Compared 189 screenshots: 189 matched. Benchmark Results
Build and Run Timing
Detailed Performance Metrics
|
Collaborator
Author
|
Compared 188 screenshots: 188 matched. Benchmark Results
Detailed Performance Metrics
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #5991.
New package
com.codename1.backend.security.pki(shared Java, so the JVM and the native build run identical code):Pem: multi-block PEM decode/encode.Certificate: X.509 parsing (names, validity, key, SAN DNS/IP/email/URI, basic constraints, key usage, EKU, SKI/AKI). Also host matching per RFC 9525 (SAN only, leftmost wildcard, IPv4/IPv6).CertificateValidator: validates a chain against explicit trust anchors only.CertificationRequest: PKCS#10 create (RSA/P-256/P-384, SAN extension request), parse and verify.Pkcs12: read and write in the PBES2/PBKDF2/AES-CBC + HMAC profile of OpenSSL 3 and current JDKs.DistinguishedName: RFC 4514 parse/format.Crypto(bothimpl/javaseandimpl/parparvm+cn1_backend_crypto.c):generateEcKey(P-256|P-384),ecdhandaesCbcEncrypt/aesCbcDecrypt. On the JVM, EC keys are written in OpenSSL's PKCS#8 shape (public point included) soDer.publicKeyOfworks on both runtimes.Profiles are documented in the package docs and in a new Backend-Security section.
Tests / fixtures
maven/backend/src/test/resources/pki/generate.sh).PkiTestcross-checks against the JDK:CertificateFactory.KeyStore, and the JDK's PKCS#12 read by us.Signature.KeyAgreement, and AES-CBC againstCipher.authcheckdemo prints 74 new deterministic VALUE lines covering parsing, every validation failure, CSRs, PKCS#12, ECDH (fixed keys) and the NIST CBC vector.BackendSecurityTestrequires those lines to match between the JVM and the native binary.backend
verify(SpotBugs, Checkstyle), the PMD report for backend and backend-parparvm, and JDK 25 doclint on the new sources are clean.🤖 Generated with Claude Code