8284105: Update security libraries to use sealed classes

Reviewed-by: darcy, weijun, xuelei

make/jdk/src/classes/build/tools/intpoly/FieldGen.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -614,7 +614,7 @@ public class FieldGen {
         }
         result.appendLine("import java.math.BigInteger;");
 
-        result.appendLine("public class " + params.getClassName()
+        result.appendLine("public final class " + params.getClassName()
                 + " extends " + this.parentName + " {");
         result.incrIndent();
 

src/java.base/share/classes/sun/security/provider/JavaKeyStore.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,7 @@ import sun.security.util.KeyStoreDelegator;
  * @since 1.2
  */
 
-public abstract class JavaKeyStore extends KeyStoreSpi {
+public abstract sealed class JavaKeyStore extends KeyStoreSpi {
 
     // regular JKS
     public static final class JKS extends JavaKeyStore {

src/java.base/share/classes/sun/security/provider/certpath/Builder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -50,7 +50,7 @@ import sun.security.x509.X509CertImpl;
  * @author      Yassir Elley
  */
 
-public abstract class Builder {
+abstract class Builder {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private Set<String> matchingPolicies;

src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,7 @@ import sun.security.x509.X509CertImpl;
  * @author      Yassir Elley
  * @author      Sean Mullan
  */
-class ForwardBuilder extends Builder {
+final class ForwardBuilder extends Builder {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private final Set<X509Certificate> trustedCerts;

src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilderResult.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@ import java.security.cert.TrustAnchor;
 //@@@ Note: this class is not in public API and access to adjacency list is
 //@@@ intended for debugging/replay of Sun PKIX CertPathBuilder implementation.
 
-public class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {
+public final class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {
 
     private static final Debug debug = Debug.getInstance("certpath");
 

src/java.base/share/classes/sun/security/provider/certpath/Vertex.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -46,7 +46,7 @@ import sun.security.x509.X509CertImpl;
  * @author      Sean Mullan
  * @since       1.4
  */
-public class Vertex {
+final class Vertex {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private X509Certificate cert;

src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@ import static sun.security.util.SecurityProviderConstants.DEF_RSASSA_PSS_KEY_SIZ
  * @since   1.5
  * @author  Andreas Sterbenz
  */
-public abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {
+abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {
 
     private static final BigInteger SQRT_2048;
     private static final BigInteger SQRT_3072;

src/java.base/share/classes/sun/security/rsa/RSASignature.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@ import sun.security.x509.AlgorithmId;
  * @since   1.5
  * @author  Andreas Sterbenz
  */
-public abstract class RSASignature extends SignatureSpi {
+abstract class RSASignature extends SignatureSpi {
 
     // we sign an ASN.1 SEQUENCE of AlgorithmId and digest
     // it has the form 30:xx:30:xx:[digestOID]:05:00:04:xx:[digest]
@@ -188,7 +188,7 @@ public abstract class RSASignature extends SignatureSpi {
         }
         byte[] digest = getDigestValue();
         try {
-            byte[] encoded = encodeSignature(digestOID, digest);
+            byte[] encoded = RSAUtil.encodeSignature(digestOID, digest);
             byte[] padded = padding.pad(encoded);
             byte[] encrypted = RSACore.rsa(padded, privateKey, true);
             return encrypted;
@@ -215,7 +215,7 @@ public abstract class RSASignature extends SignatureSpi {
             byte[] digest = getDigestValue();
             byte[] decrypted = RSACore.rsa(sigBytes, publicKey);
             byte[] unpadded = padding.unpad(decrypted);
-            byte[] decodedDigest = decodeSignature(digestOID, unpadded);
+            byte[] decodedDigest = RSAUtil.decodeSignature(digestOID, unpadded);
             return MessageDigest.isEqual(digest, decodedDigest);
         } catch (javax.crypto.BadPaddingException e) {
             // occurs if the app has used the wrong RSA public key
@@ -230,44 +230,6 @@ public abstract class RSASignature extends SignatureSpi {
         }
     }
 
-    /**
-     * Encode the digest, return the to-be-signed data.
-     * Also used by the PKCS#11 provider.
-     */
-    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
-            throws IOException {
-        DerOutputStream out = new DerOutputStream();
-        new AlgorithmId(oid).encode(out);
-        out.putOctetString(digest);
-        DerValue result =
-            new DerValue(DerValue.tag_Sequence, out.toByteArray());
-        return result.toByteArray();
-    }
-
-    /**
-     * Decode the signature data. Verify that the object identifier matches
-     * and return the message digest.
-     */
-    public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
-            throws IOException {
-        // Enforce strict DER checking for signatures
-        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
-        DerValue[] values = in.getSequence(2);
-        if ((values.length != 2) || (in.available() != 0)) {
-            throw new IOException("SEQUENCE length error");
-        }
-        AlgorithmId algId = AlgorithmId.parse(values[0]);
-        if (algId.getOID().equals(oid) == false) {
-            throw new IOException("ObjectIdentifier mismatch: "
-                + algId.getOID());
-        }
-        if (algId.getEncodedParams() != null) {
-            throw new IOException("Unexpected AlgorithmId parameters");
-        }
-        byte[] digest = values[1].getOctetString();
-        return digest;
-    }
-
     // set parameter, not supported. See JCA doc
     @Deprecated
     @Override

src/java.base/share/classes/sun/security/rsa/RSAUtil.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,8 +25,12 @@
 
 package sun.security.rsa;
 
+import java.io.IOException;
 import java.security.*;
 import java.security.spec.*;
+import sun.security.util.DerInputStream;
+import sun.security.util.DerOutputStream;
+import sun.security.util.DerValue;
 import sun.security.util.ObjectIdentifier;
 import sun.security.x509.AlgorithmId;
 
@@ -161,4 +165,42 @@ public class RSAUtil {
         result[1] = getParamSpec(algid.getParameters());
         return result;
     }
+
+    /**
+     * Encode the digest, return the to-be-signed data.
+     * Also used by the PKCS#11 provider.
+     */
+    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
+            throws IOException {
+        DerOutputStream out = new DerOutputStream();
+        new AlgorithmId(oid).encode(out);
+        out.putOctetString(digest);
+        DerValue result =
+            new DerValue(DerValue.tag_Sequence, out.toByteArray());
+        return result.toByteArray();
+    }
+
+    /**
+     * Decode the signature data. Verify that the object identifier matches
+     * and return the message digest.
+     */
+    public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
+            throws IOException {
+        // Enforce strict DER checking for signatures
+        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
+        DerValue[] values = in.getSequence(2);
+        if ((values.length != 2) || (in.available() != 0)) {
+            throw new IOException("SEQUENCE length error");
+        }
+        AlgorithmId algId = AlgorithmId.parse(values[0]);
+        if (algId.getOID().equals(oid) == false) {
+            throw new IOException("ObjectIdentifier mismatch: "
+                + algId.getOID());
+        }
+        if (algId.getEncodedParams() != null) {
+            throw new IOException("Unexpected AlgorithmId parameters");
+        }
+        byte[] digest = values[1].getOctetString();
+        return digest;
+    }
 }

src/java.base/share/classes/sun/security/timestamp/TSResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -99,7 +99,7 @@ import sun.security.util.DerValue;
  * @see Timestamper
  */
 
-public class TSResponse {
+public final class TSResponse {
 
     // Status codes (from RFC 3161)
 

src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -61,7 +61,14 @@ import java.util.Arrays;
  *
  */
 
-public abstract class IntegerPolynomial implements IntegerFieldModuloP {
+public abstract sealed class IntegerPolynomial implements IntegerFieldModuloP
+    permits IntegerPolynomial1305, IntegerPolynomial25519,
+            IntegerPolynomial448, IntegerPolynomialP256,
+            IntegerPolynomialP384, IntegerPolynomialP521,
+            IntegerPolynomialModBinP, P256OrderField,
+            P384OrderField, P521OrderField,
+            sun.security.util.math.intpoly.Curve25519OrderField,
+            sun.security.util.math.intpoly.Curve448OrderField {
 
     protected static final BigInteger TWO = BigInteger.valueOf(2);
 

src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial1305.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -35,7 +35,7 @@ import java.nio.*;
  * The representation uses 5 signed long values.
  */
 
-public class IntegerPolynomial1305 extends IntegerPolynomial {
+public final class IntegerPolynomial1305 extends IntegerPolynomial {
 
     protected static final int SUBTRAHEND = 5;
     protected static final int NUM_LIMBS = 5;

src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial25519.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@ import java.math.BigInteger;
  * The representation uses 10 signed long values.
  */
 
-public class IntegerPolynomial25519 extends IntegerPolynomial {
+public final class IntegerPolynomial25519 extends IntegerPolynomial {
 
     private static final int POWER = 255;
     private static final int SUBTRAHEND = 19;

src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial448.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@ import java.math.BigInteger;
  * The representation uses 16 signed long values.
  */
 
-public class IntegerPolynomial448 extends IntegerPolynomial {
+public final class IntegerPolynomial448 extends IntegerPolynomial {
 
     private static final int POWER = 448;
     private static final int NUM_LIMBS = 16;

src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomialModBinP.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2020, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,7 +38,7 @@ import java.nio.ByteBuffer;
  * This class may only be used for primes of the form 2^a + b.
  */
 
-public class IntegerPolynomialModBinP extends IntegerPolynomial {
+public sealed class IntegerPolynomialModBinP extends IntegerPolynomial {
 
     private final long[] reduceLimbs;
     private final int bitOffset;
@@ -206,7 +206,7 @@ public class IntegerPolynomialModBinP extends IntegerPolynomial {
     /**
      * The field of integers modulo the order of the Curve25519 subgroup
      */
-    public static class Curve25519OrderField extends IntegerPolynomialModBinP {
+    public final static class Curve25519OrderField extends IntegerPolynomialModBinP {
 
         public Curve25519OrderField() {
             super(26, 10, 252,
@@ -217,7 +217,7 @@ public class IntegerPolynomialModBinP extends IntegerPolynomial {
     /**
      * The field of integers modulo the order of the Curve448 subgroup
      */
-    public static class Curve448OrderField extends IntegerPolynomialModBinP {
+    public final static class Curve448OrderField extends IntegerPolynomialModBinP {
 
         public Curve448OrderField() {
             super(28, 16, 446,

src/java.base/share/classes/sun/security/validator/Validator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -83,7 +83,7 @@ import java.security.cert.*;
  *
  * @author Andreas Sterbenz
  */
-public abstract class Validator {
+public abstract sealed class Validator permits PKIXValidator, SimpleValidator {
 
     static final X509Certificate[] CHAIN0 = {};
 

src/java.security.jgss/share/classes/sun/security/jgss/GSSCaller.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,8 @@ package sun.security.jgss;
  * into the mechanism level so that special actions can be performed for
  * different callers.
  */
-public class GSSCaller {
+public sealed class GSSCaller permits HttpCaller {
+
     public static final GSSCaller CALLER_UNKNOWN = new GSSCaller("UNKNOWN");
     public static final GSSCaller CALLER_INITIATE = new GSSCaller("INITIATE");
     public static final GSSCaller CALLER_ACCEPT = new GSSCaller("ACCEPT");

src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -80,7 +80,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
  * @since 1.4
  */
 
-public class GSSNameImpl implements GSSName {
+public final class GSSNameImpl implements GSSName {
 
     /**
      * The old Oid used in RFC 2853. Now supported as

src/java.security.jgss/share/classes/sun/security/jgss/HttpCaller.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,7 @@ import sun.net.www.protocol.http.HttpCallerInfo;
  * A special kind of GSSCaller, which origins from HTTP/Negotiate and contains
  * info about what triggers the JGSS calls.
  */
-public class HttpCaller extends GSSCaller {
+public final class HttpCaller extends GSSCaller {
     private final HttpCallerInfo hci;
 
     public HttpCaller(HttpCallerInfo hci) {

src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5ProxyCredential.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -45,7 +45,7 @@ import javax.security.auth.kerberos.KerberosTicket;
  * @since 1.8
  */
 
-public class Krb5ProxyCredential
+final class Krb5ProxyCredential
     implements Krb5CredElement {
 
     public final Krb5InitCredential self;   // the middle server

src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -44,7 +44,7 @@ import sun.security.jgss.krb5.Krb5Util;
  * This class encapsulates a AS-REP message that the KDC sends to the
  * client.
  */
-class KrbAsRep extends KrbKdcRep {
+final class KrbAsRep extends KrbKdcRep {
 
     private ASRep rep;  // The AS-REP message
     private Credentials creds;  // The Credentials provide by the AS-REP

src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,7 +40,7 @@ import java.io.IOException;
  * This class encapsulates a TGS-REP that is sent from the KDC to the
  * Kerberos client.
  */
-public class KrbTgsRep extends KrbKdcRep {
+final class KrbTgsRep extends KrbKdcRep {
     private TGSRep rep;
     private Credentials creds;
     private Credentials additionalCreds;
@@ -121,7 +121,7 @@ public class KrbTgsRep extends KrbKdcRep {
     /**
      * Return the credentials that were contained in this KRB-TGS-REP.
      */
-    public Credentials getCreds() {
+    Credentials getCreds() {
         return creds;
     }
 

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Signature.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -37,7 +37,7 @@ import sun.nio.ch.DirectBuffer;
 import sun.security.util.*;
 import sun.security.x509.AlgorithmId;
 
-import sun.security.rsa.RSASignature;
+import sun.security.rsa.RSAUtil;
 import sun.security.rsa.RSAPadding;
 
 import sun.security.pkcs11.wrapper.*;
@@ -766,7 +766,7 @@ final class P11Signature extends SignatureSpi {
 
     private byte[] encodeSignature(byte[] digest) throws SignatureException {
         try {
-            return RSASignature.encodeSignature(digestOID, digest);
+            return RSAUtil.encodeSignature(digestOID, digest);
         } catch (IOException e) {
             throw new SignatureException("Invalid encoding", e);
         }