(tomcat) branch 11.0.x updated: Update default encryptionAlgorithm to "AES/GCM/NoPadding"

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new db6f028c45 Update default encryptionAlgorithm to "AES/GCM/NoPadding"
db6f028c45 is described below

commit db6f028c458a76f5708eb06af497fe2a55f24072
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Jul 7 12:04:25 2026 +0100

    Update default encryptionAlgorithm to "AES/GCM/NoPadding"
---
 .../catalina/tribes/group/interceptors/EncryptInterceptor.java   | 5 ++---
 webapps/docs/changelog.xml                                       | 9 +++++++++
 webapps/docs/config/cluster-interceptor.xml                      | 5 ++---
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
index 1712f4cf90..493406de24 100644
--- a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
+++ b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
@@ -62,7 +62,7 @@ public class EncryptInterceptor extends ChannelInterceptorBase implements Encryp
      */
     protected static final StringManager sm = StringManager.getManager(EncryptInterceptor.class);
 
-    private static final String DEFAULT_ENCRYPTION_ALGORITHM = "AES/CBC/PKCS5Padding";
+    private static final String DEFAULT_ENCRYPTION_ALGORITHM = "AES/GCM/NoPadding";
 
     private String providerName;
     private String encryptionAlgorithm = DEFAULT_ENCRYPTION_ALGORITHM;
@@ -186,8 +186,7 @@ public class EncryptInterceptor extends ChannelInterceptorBase implements Encryp
      * Sets the encryption algorithm to be used for encrypting and decrypting channel messages. You must specify the
      * <code>algorithm/mode/padding</code>. Information on standard algorithm names may be found in the
      * <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html">Java
-     * documentation</a>. Default is <code>AES/CBC/PKCS5Padding</code> for backwards compatibility but it is recommended
-     * that <code>AES/GCM/NoPadding</code> is used.
+     * documentation</a>. Default is <code>AES/GCM/NoPadding</code>.
      *
      * @param algorithm The algorithm to use.
      */
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 0a8822c969..b1e0fc4920 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -124,6 +124,15 @@
       </update>
     </changelog>
   </subsection>
+  <subsection name="Cluster">
+    <changelog>
+      <add>
+        Change the default <code>encryptionAlgorithm</code> for the
+        <code>EncryptInterceptor</code> to <code>AES/GCM/NoPadding</code>. This
+        is a breaking change for the <code>EncryptInterceptor</code>. (markt)
+      </add>
+    </changelog>
+  </subsection>
 </section>
 <section name="Tomcat 11.0.24 (markt)" rtext="release in progress">
   <subsection name="Catalina">
diff --git a/webapps/docs/config/cluster-interceptor.xml b/webapps/docs/config/cluster-interceptor.xml
index 16695586c0..e5834d3958 100644
--- a/webapps/docs/config/cluster-interceptor.xml
+++ b/webapps/docs/config/cluster-interceptor.xml
@@ -260,9 +260,8 @@
        <p>The length of the key will specify the flavor of the encryption
        algorithm to be used, if applicable (e.g. AES-128 versus AES-256).</p>
 
-       <p>The default algorithm is <code>AES/CBC/PKCS5Padding</code> for
-       backwards compatability but it is recommended that
-       <code>AES/GCM/NoPadding</code> is used.</p>
+       <p>If not specified, the default algorithm is
+       <code>AES/GCM/NoPadding</code>.</p>
      </attribute>
      <attribute name="encryptionKey" required="true">
        <p>The key to be used with the encryption algorithm.</p>