Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A suggestion about specifying a source of secure randomness for better security #14026

Closed
Gax-c opened this issue Apr 30, 2024 · 5 comments · Fixed by #14058
Closed

A suggestion about specifying a source of secure randomness for better security #14026

Gax-c opened this issue Apr 30, 2024 · 5 comments · Fixed by #14058

Comments

@Gax-c
Copy link

Gax-c commented Apr 30, 2024

Hello everyone! I'm new to netty and when I was browsing the code I found the following code in JdkSslServerContext.java here:

            ctx.init(keyManagerFactory.getKeyManagers(),
                    wrapTrustManagerIfNeeded(trustManagerFactory.getTrustManagers()),
                     null);

The code here use a "null", which means using the default securerandom. Although securerandom has already provided enough security, specifying one will ensure better security. For example, using SunJSSE.cryptoProvider for fip mode will be better.
@hyperxpro
Copy link
Contributor

Looks valid. @normanmaurer WDYT?

@normanmaurer
Copy link
Member

@hyperxpro @Gax-c I think we could add another constructor that take one ?

@hyperxpro
Copy link
Contributor

Yup. Shall I go ahead with a PR?

@normanmaurer
Copy link
Member

@hyperxpro sure

@thxwelchs thxwelchs mentioned this issue May 19, 2024
Merged
@thxwelchs
Copy link
Contributor

thxwelchs commented May 19, 2024 •
edited
Loading

Hi @normanmaurer, @hyperxpro, @Gax-c

I'm interested in this so I created a PR. Could you please review this?

#14058

normanmaurer added a commit that referenced this issue May 22, 2024
@thxwelchs @normanmaurer
Add support for specifying SecureRandom in SSLContext initialization (#…
ebf0e41 
…14058)

Motivation:

Enhance security by supporting specific secure randomness source in
SSLContext initialization

Modification:

Support building SecureRandom in `SslContextBuilder`.
Allow passing SecureRandom as a parameter when creating an instance of
`JdkSslServerContext` through its constructor.

Result:

Enhance security

Fixes #14026

---------

Co-authored-by: Norman Maurer <norman_maurer@apple.com>
normanmaurer added a commit that referenced this issue May 22, 2024
@thxwelchs @normanmaurer
Add support for specifying SecureRandom in SSLContext initialization (#…
9841b19 
…14058)

Motivation:

Enhance security by supporting specific secure randomness source in
SSLContext initialization

Modification:

Support building SecureRandom in `SslContextBuilder`.
Allow passing SecureRandom as a parameter when creating an instance of
`JdkSslServerContext` through its constructor.

Result:

Enhance security

Fixes #14026

---------

Co-authored-by: Norman Maurer <norman_maurer@apple.com>
normanmaurer added a commit that referenced this issue May 22, 2024
@thxwelchs @normanmaurer
Add support for specifying SecureRandom in SSLContext initialization (#…
f3ff91c 
…14058)

Motivation:

Enhance security by supporting specific secure randomness source in
SSLContext initialization

Modification:

Support building SecureRandom in `SslContextBuilder`.
Allow passing SecureRandom as a parameter when creating an instance of
`JdkSslServerContext` through its constructor.

Result:

Enhance security

Fixes #14026

---------

Co-authored-by: Norman Maurer <norman_maurer@apple.com>
normanmaurer added a commit to yawkat/netty that referenced this issue Jul 17, 2024
@thxwelchs @normanmaurer
Add support for specifying SecureRandom in SSLContext initialization (n…
1d4bf41 
…etty#14058)

Motivation:

Enhance security by supporting specific secure randomness source in
SSLContext initialization

Modification:

Support building SecureRandom in `SslContextBuilder`.
Allow passing SecureRandom as a parameter when creating an instance of
`JdkSslServerContext` through its constructor.

Result:

Enhance security

Fixes netty#14026

---------

Co-authored-by: Norman Maurer <norman_maurer@apple.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add support for specifying SecureRandom in SSLContext initialization thxwelchs/netty
4 participants
@normanmaurer @hyperxpro @thxwelchs @Gax-c