Mailing-List: contact harmony-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: harmony-dev@incubator.apache.org
Received-SPF: pass (asf.osuosl.org: domain of george.c.harley@googlemail.com
 designates 66.249.92.207 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=googlemail.com;
        h=received:message-id:date:from:reply-to:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=nFW+H4b+6X0TYSK2HlFegAUbViQg/OWEx/+fRAe8XNxpu2hjXPzSnoZX6/09YCU7+v6i0ioo1TIU5I/wDQ1OHpnZU6NhqJT11irLvj6TxQujdk0w5Dd8vvOxEV2ZMW90SloSSLLK59EPkhC2yc2Kz3xfMqMsHijbK+cJO6AvUd8=
Message-ID: <43EC7AC3.1010202@googlemail.com>
Date: Fri, 10 Feb 2006 11:36:35 +0000
From: George Harley <george.c.harley@googlemail.com>
Reply-To: george.c.harley@googlemail.com
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
To: harmony-dev@incubator.apache.org
Subject: Re: verifying signed jars
References: <43EB3119.8030801@gmail.com>
 <43EB3550.2030000@pobox.com>	 <43EB4AEF.70005@googlemail.com>
 <43EB82D9.7070405@gmail.com>	 <43EB8D67.4080509@pobox.com>
	 <6e47b64f0602092246k20dca2b3wbb4154bcb1e85089@mail.gmail.com>
	 <43EC604E.3040706@gmail.com> <43EC6F59.10603@googlemail.com>
 <6e47b64f0602100251p298009d1g24cb83768f039ccc@mail.gmail.com>
In-Reply-To: <6e47b64f0602100251p298009d1g24cb83768f039ccc@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi Stepan,

In the short term, yes, SHA-1 and DSA should suffice for verifying the 
BouncyCastle provider jar. Long term though, Harmony will also need to 
support the MD5 and RSA algorithms for other providers that may have 
been signed with those algorithms. While the Jar file specification does 
not mandate a set of digest and signature algorithms that may be used 
for signing, it should be noted that the reference jarsigner tool 
supports both DSA+SHA-1 and RSA+MD5.

Best regards,
George
IBM UK

PS, Keeping my fingers crossed this ends up on the dev-list :-)


Stepan Mishura wrote:
>
> We should have at least to verify BC provider:
> 1) Message digest algorithm: SHA-1
> 2) Signature algorithm: SHA1withDSA
>
> Other jars may require additional algorithms, for example, 
> SHA1withRSA. We can verify BC provider first and use it for further 
> jar verifications.
>
>  
> Thanks,
> Stepan Mishura
> Intel Middleware Products Division
>
>
>  
> On 2/10/06, *George Harley* <george.c.harley@googlemail.com 
> <mailto:george.c.harley@googlemail.com>> wrote:
>
>     Hi Tim,
>
>     In order to verify the signature of those signed provider jars I
>     believe
>     that you would also need trusted implementations of :
>
>     * SHA-1 and MD5 digest algorithms
>     * DSA and RSA signature algorithms
>
>
>     Best regards,
>     George
>     IBM UK
>
>
>     Tim Ellison wrote:
>     > Stepan Mishura wrote:
>     > <snip>
>     >
>     >> Returning back to the 'missing post'. I agreed with suggestion
>     but currently
>     >> we don't have Harmony provider so we should define how we
>     locate 'trusted
>     >> provides' to be secure.
>     >>
>     >
>     > We just need a trusted SHA1PRNG, right? then we can open signed
>     > providers' jars and get any others.
>     >
>     > Regards,
>     > Tim
>     >
>     >
>
>
>
>
> --