(tomcat) branch 10.1.x updated: Update default encryptionAlgorithm to "AES/GCM/NoPadding"

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/10.1.x by this push:
     new 1c74eaa125 Update default encryptionAlgorithm to "AES/GCM/NoPadding"
1c74eaa125 is described below

commit 1c74eaa1253b9ab620425fb5a20479717bfc5630
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Jul 7 12:04:25 2026 +0100

    Update default encryptionAlgorithm to "AES/GCM/NoPadding"
---
 .../catalina/tribes/group/interceptors/EncryptInterceptor.java   | 5 ++---
 webapps/docs/changelog.xml                                       | 9 +++++++++
 webapps/docs/config/cluster-interceptor.xml                      | 5 ++---
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
index eabc8313da..d2f13de1f6 100644
--- a/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
+++ b/java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java
@@ -61,7 +61,7 @@ public class EncryptInterceptor extends ChannelInterceptorBase implements Encryp
      */
     protected static final StringManager sm = StringManager.getManager(EncryptInterceptor.class);
 
-    private static final String DEFAULT_ENCRYPTION_ALGORITHM = "AES/CBC/PKCS5Padding";
+    private static final String DEFAULT_ENCRYPTION_ALGORITHM = "AES/GCM/NoPadding";
 
     private String providerName;
     private String encryptionAlgorithm = DEFAULT_ENCRYPTION_ALGORITHM;
@@ -185,8 +185,7 @@ public class EncryptInterceptor extends ChannelInterceptorBase implements Encryp
      * Sets the encryption algorithm to be used for encrypting and decrypting channel messages. You must specify the
      * <code>algorithm/mode/padding</code>. Information on standard algorithm names may be found in the
      * <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html">Java
-     * documentation</a>. Default is <code>AES/CBC/PKCS5Padding</code> for backwards compatibility but it is recommended
-     * that <code>AES/GCM/NoPadding</code> is used.
+     * documentation</a>. Default is <code>AES/GCM/NoPadding</code>.
      *
      * @param algorithm The algorithm to use.
      */
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index d00963b2f5..061073e30e 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -124,6 +124,15 @@
       </update>
     </changelog>
   </subsection>
+  <subsection name="Cluster">
+    <changelog>
+      <add>
+        Change the default <code>encryptionAlgorithm</code> for the
+        <code>EncryptInterceptor</code> to <code>AES/GCM/NoPadding</code>. This
+        is a breaking change for the <code>EncryptInterceptor</code>. (markt)
+      </add>
+    </changelog>
+  </subsection>
 </section>
 <section name="Tomcat 10.1.57 (schultz)" rtext="release in progress">
   <subsection name="Catalina">
diff --git a/webapps/docs/config/cluster-interceptor.xml b/webapps/docs/config/cluster-interceptor.xml
index 16695586c0..e5834d3958 100644
--- a/webapps/docs/config/cluster-interceptor.xml
+++ b/webapps/docs/config/cluster-interceptor.xml
@@ -260,9 +260,8 @@
        <p>The length of the key will specify the flavor of the encryption
        algorithm to be used, if applicable (e.g. AES-128 versus AES-256).</p>
 
-       <p>The default algorithm is <code>AES/CBC/PKCS5Padding</code> for
-       backwards compatability but it is recommended that
-       <code>AES/GCM/NoPadding</code> is used.</p>
+       <p>If not specified, the default algorithm is
+       <code>AES/GCM/NoPadding</code>.</p>
      </attribute>
      <attribute name="encryptionKey" required="true">
        <p>The key to be used with the encryption algorithm.</p>