Skip to content

CAUTION: This site hosts draft documentation for the next release. For published content of the latest release, visit www.eclipse.org/openj9/docs

Enhancements to OpenJDK security

Eclipse OpenJ9™ includes the following enhancements to the OpenJDK security components.

Start of content that applies to Java 11 (LTS) and later Support for PKCS#11 token labels

(z/OS® and Linux on IBM Z® only)

On z/OS and Linux on IBM Z, OpenJ9 supports the use of an extra attribute, tokenlabel, in the SunPKCS11 configuration file. Use this attribute to assign a label to a PKCS#11 token.

The number of slots and their order depend on the number of tokens in the ICSF token database, their values, and the SAF CRYPTOZ class protection profiles that are currently defined. The ICSF PKCS#11 support ensures that a token resides in its current slot only for the duration of a PKCS#11 session (if the token is not deleted). If you restart an application, or tokens are created or removed, the token might move to a different slot. An application that uses the slot or slotListIndex attributes might fail if it doesn’t first check which slot the token is in. You can avoid this issue by using the tokenlabel attribute instead.

You can specify only one of the attributes - slot, slotListIndex, or tokenlabel. If you do not specify any of these attributes, the default behavior is that the slotListIndex attribute is set to 0.

Note: To configure an ICSF token, add the ICSF token to openCryptoki by using the pkcsicsf utility. The openCryptoki library loads the tokens that provide hardware or software specific support for cryptographic functions. An openCryptoki token uses an RSA key pair of public and private keys to encrypt and decrypt data. Start of content that applies to Java 17 plus You must have openCryptoki version 3.22 or later to generate RSA private keys with the ICA, CCA and EP11 tokens that openCryptoki supports. End of content that applies only to Java 17 (LTS) and later

For more information about the SunPKCS11 configuration file, see PKCS#11 Reference Guide.