Merge "java.security: update classes in java.security"
diff --git a/luni/src/test/java/libcore/java/security/MessageDigestTest.java b/luni/src/test/java/libcore/java/security/MessageDigestTest.java
index 60dc36a..1a00af4 100644
--- a/luni/src/test/java/libcore/java/security/MessageDigestTest.java
+++ b/luni/src/test/java/libcore/java/security/MessageDigestTest.java
@@ -307,4 +307,10 @@
 
         assertEquals(Collections.EMPTY_LIST, methodsNotOverridden);
     }
+
+    public void testIsEqual_nullValues() {
+        assertTrue(MessageDigest.isEqual(null, null));
+        assertFalse(MessageDigest.isEqual(null, new byte[1]));
+        assertFalse(MessageDigest.isEqual(new byte[1], null));
+    }
 }
diff --git a/ojluni/src/main/java/java/security/AccessControlException.java b/ojluni/src/main/java/java/security/AccessControlException.java
index baab01b..a4f2a78 100644
--- a/ojluni/src/main/java/java/security/AccessControlException.java
+++ b/ojluni/src/main/java/java/security/AccessControlException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -44,11 +44,11 @@
 
     private static final long serialVersionUID = 5138225684096988535L;
 
-    // the permission that caused the exeception to be thrown.
+    // the permission that caused the exception to be thrown.
     private Permission perm;
 
     /**
-     * Constructs an <code>AccessControlException</code> with the
+     * Constructs an {@code AccessControlException} with the
      * specified, detailed message.
      *
      * @param   s   the detail message.
@@ -58,7 +58,7 @@
     }
 
     /**
-     * Constructs an <code>AccessControlException</code> with the
+     * Constructs an {@code AccessControlException} with the
      * specified, detailed message, and the requested permission that caused
      * the exception.
      *
@@ -71,7 +71,7 @@
     }
 
     /**
-     * Gets the Permission object associated with this exeception, or
+     * Gets the Permission object associated with this exception, or
      * null if there was no corresponding Permission object.
      *
      * @return the Permission object.
diff --git a/ojluni/src/main/java/java/security/AlgorithmParameterGenerator.java b/ojluni/src/main/java/java/security/AlgorithmParameterGenerator.java
index 9e0bc55..5224158 100644
--- a/ojluni/src/main/java/java/security/AlgorithmParameterGenerator.java
+++ b/ojluni/src/main/java/java/security/AlgorithmParameterGenerator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -28,10 +28,10 @@
 import java.security.spec.AlgorithmParameterSpec;
 
 /**
- * The <code>AlgorithmParameterGenerator</code> class is used to generate a
+ * The {@code AlgorithmParameterGenerator} class is used to generate a
  * set of
  * parameters to be used with a certain algorithm. Parameter generators
- * are constructed using the <code>getInstance</code> factory methods
+ * are constructed using the {@code getInstance} factory methods
  * (static methods that return instances of a given class).
  *
  * <P>The object that will generate the parameters can be initialized
@@ -48,7 +48,7 @@
  * of the prime modulus (in bits).
  * When using this approach, algorithm-specific parameter generation
  * values - if any - default to some standard values, unless they can be
- * derived from the specified size.<P>
+ * derived from the specified size.
  *
  * <li>The other approach initializes a parameter generator object
  * using algorithm-specific semantics, which are represented by a set of
@@ -61,7 +61,7 @@
  *
  * <P>In case the client does not explicitly initialize the
  * AlgorithmParameterGenerator
- * (via a call to an <code>init</code> method), each provider must supply (and
+ * (via a call to an {@code init} method), each provider must supply (and
  * document) a default initialization. For example, the Sun provider uses a
  * default modulus prime size of 1024 bits for the generation of DSA
  * parameters.
@@ -295,11 +295,11 @@
 
     /**
      * Initializes this parameter generator for a certain size.
-     * To create the parameters, the <code>SecureRandom</code>
+     * To create the parameters, the {@code SecureRandom}
      * implementation of the highest-priority installed provider is used as
      * the source of randomness.
      * (If none of the installed providers supply an implementation of
-     * <code>SecureRandom</code>, a system-provided source of randomness is
+     * {@code SecureRandom}, a system-provided source of randomness is
      * used.)
      *
      * @param size the size (number of bits).
@@ -322,11 +322,11 @@
     /**
      * Initializes this parameter generator with a set of algorithm-specific
      * parameter generation values.
-     * To generate the parameters, the <code>SecureRandom</code>
+     * To generate the parameters, the {@code SecureRandom}
      * implementation of the highest-priority installed provider is used as
      * the source of randomness.
      * (If none of the installed providers supply an implementation of
-     * <code>SecureRandom</code>, a system-provided source of randomness is
+     * {@code SecureRandom}, a system-provided source of randomness is
      * used.)
      *
      * @param genParamSpec the set of algorithm-specific parameter generation values.
diff --git a/ojluni/src/main/java/java/security/AlgorithmParameterGeneratorSpi.java b/ojluni/src/main/java/java/security/AlgorithmParameterGeneratorSpi.java
index 729470a..721fb52 100644
--- a/ojluni/src/main/java/java/security/AlgorithmParameterGeneratorSpi.java
+++ b/ojluni/src/main/java/java/security/AlgorithmParameterGeneratorSpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1999, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -29,7 +29,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>AlgorithmParameterGenerator</code> class, which
+ * for the {@code AlgorithmParameterGenerator} class, which
  * is used to generate a set of parameters to be used with a certain algorithm.
  *
  * <p> All the abstract methods in this class must be implemented by each
@@ -37,7 +37,7 @@
  * of a parameter generator for a particular algorithm.
  *
  * <p> In case the client does not explicitly initialize the
- * AlgorithmParameterGenerator (via a call to an <code>engineInit</code>
+ * AlgorithmParameterGenerator (via a call to an {@code engineInit}
  * method), each provider must supply (and document) a default initialization.
  * For example, the Sun provider uses a default modulus prime size of 1024
  * bits for the generation of DSA parameters.
diff --git a/ojluni/src/main/java/java/security/AlgorithmParameters.java b/ojluni/src/main/java/java/security/AlgorithmParameters.java
index a090ece..af5ed7e 100644
--- a/ojluni/src/main/java/java/security/AlgorithmParameters.java
+++ b/ojluni/src/main/java/java/security/AlgorithmParameters.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,19 +32,19 @@
 /**
  * This class is used as an opaque representation of cryptographic parameters.
  *
- * <p>An <code>AlgorithmParameters</code> object for managing the parameters
+ * <p>An {@code AlgorithmParameters} object for managing the parameters
  * for a particular algorithm can be obtained by
- * calling one of the <code>getInstance</code> factory methods
+ * calling one of the {@code getInstance} factory methods
  * (static methods that return instances of a given class).
  *
- * <p>Once an <code>AlgorithmParameters</code> object is obtained, it must be
- * initialized via a call to <code>init</code>, using an appropriate parameter
+ * <p>Once an {@code AlgorithmParameters} object is obtained, it must be
+ * initialized via a call to {@code init}, using an appropriate parameter
  * specification or parameter encoding.
  *
  * <p>A transparent parameter specification is obtained from an
- * <code>AlgorithmParameters</code> object via a call to
- * <code>getParameterSpec</code>, and a byte encoding of the parameters is
- * obtained via a call to <code>getEncoded</code>.
+ * {@code AlgorithmParameters} object via a call to
+ * {@code getParameterSpec}, and a byte encoding of the parameters is
+ * obtained via a call to {@code getEncoded}.
  *
  * <p> Android provides the following <code>AlgorithmParameters</code> algorithms:
  * <table>
@@ -168,7 +168,7 @@
      * the {@link Security#getProviders() Security.getProviders()} method.
      *
      * <p> The returned parameter object must be initialized via a call to
-     * <code>init</code>, using an appropriate parameter specification or
+     * {@code init}, using an appropriate parameter specification or
      * parameter encoding.
      *
      * @param algorithm the name of the algorithm requested.
@@ -210,7 +210,7 @@
      * the {@link Security#getProviders() Security.getProviders()} method.
      *
      * <p>The returned parameter object must be initialized via a call to
-     * <code>init</code>, using an appropriate parameter specification or
+     * {@code init}, using an appropriate parameter specification or
      * parameter encoding.
      *
      * @param algorithm the name of the algorithm requested.
@@ -257,7 +257,7 @@
      * does not have to be registered in the provider list.
      *
      * <p>The returned parameter object must be initialized via a call to
-     * <code>init</code>, using an appropriate parameter specification or
+     * {@code init}, using an appropriate parameter specification or
      * parameter encoding.
      *
      * @param algorithm the name of the algorithm requested.
@@ -304,7 +304,7 @@
 
     /**
      * Initializes this parameter object using the parameters
-     * specified in <code>paramSpec</code>.
+     * specified in {@code paramSpec}.
      *
      * @param paramSpec the parameter specification.
      *
@@ -340,9 +340,9 @@
     }
 
     /**
-     * Imports the parameters from <code>params</code> and decodes them
+     * Imports the parameters from {@code params} and decodes them
      * according to the specified decoding scheme.
-     * If <code>format</code> is null, the
+     * If {@code format} is null, the
      * primary decoding format for parameters is used. The primary decoding
      * format is ASN.1, if an ASN.1 specification for these parameters
      * exists.
@@ -363,12 +363,13 @@
 
     /**
      * Returns a (transparent) specification of this parameter object.
-     * <code>paramSpec</code> identifies the specification class in which
+     * {@code paramSpec} identifies the specification class in which
      * the parameters should be returned. It could, for example, be
-     * <code>DSAParameterSpec.class</code>, to indicate that the
+     * {@code DSAParameterSpec.class}, to indicate that the
      * parameters should be returned in an instance of the
-     * <code>DSAParameterSpec</code> class.
+     * {@code DSAParameterSpec} class.
      *
+     * @param <T> the type of the parameter specification to be returrned
      * @param paramSpec the specification class in which
      * the parameters should be returned.
      *
@@ -408,7 +409,7 @@
 
     /**
      * Returns the parameters encoded in the specified scheme.
-     * If <code>format</code> is null, the
+     * If {@code format} is null, the
      * primary encoding format for parameters is used. The primary encoding
      * format is ASN.1, if an ASN.1 specification for these parameters
      * exists.
diff --git a/ojluni/src/main/java/java/security/AlgorithmParametersSpi.java b/ojluni/src/main/java/java/security/AlgorithmParametersSpi.java
index 17db77e..282493b 100644
--- a/ojluni/src/main/java/java/security/AlgorithmParametersSpi.java
+++ b/ojluni/src/main/java/java/security/AlgorithmParametersSpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2004, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>AlgorithmParameters</code> class, which is used to manage
+ * for the {@code AlgorithmParameters} class, which is used to manage
  * algorithm parameters.
  *
  * <p> All the abstract methods in this class must be implemented by each
@@ -52,7 +52,7 @@
 
     /**
      * Initializes this parameters object using the parameters
-     * specified in <code>paramSpec</code>.
+     * specified in {@code paramSpec}.
      *
      * @param paramSpec the parameter specification.
      *
@@ -77,9 +77,9 @@
         throws IOException;
 
     /**
-     * Imports the parameters from <code>params</code> and
+     * Imports the parameters from {@code params} and
      * decodes them according to the specified decoding format.
-     * If <code>format</code> is null, the
+     * If {@code format} is null, the
      * primary decoding format for parameters is used. The primary decoding
      * format is ASN.1, if an ASN.1 specification for these parameters
      * exists.
@@ -96,11 +96,13 @@
     /**
      * Returns a (transparent) specification of this parameters
      * object.
-     * <code>paramSpec</code> identifies the specification class in which
+     * {@code paramSpec} identifies the specification class in which
      * the parameters should be returned. It could, for example, be
-     * <code>DSAParameterSpec.class</code>, to indicate that the
+     * {@code DSAParameterSpec.class}, to indicate that the
      * parameters should be returned in an instance of the
-     * <code>DSAParameterSpec</code> class.
+     * {@code DSAParameterSpec} class.
+     *
+     * @param <T> the type of the parameter specification to be returned
      *
      * @param paramSpec the specification class in which
      * the parameters should be returned.
@@ -128,7 +130,7 @@
 
     /**
      * Returns the parameters encoded in the specified format.
-     * If <code>format</code> is null, the
+     * If {@code format} is null, the
      * primary encoding format for parameters is used. The primary encoding
      * format is ASN.1, if an ASN.1 specification for these parameters
      * exists.
diff --git a/ojluni/src/main/java/java/security/Certificate.java b/ojluni/src/main/java/java/security/Certificate.java
index 000a5e0..489c6d6 100644
--- a/ojluni/src/main/java/java/security/Certificate.java
+++ b/ojluni/src/main/java/java/security/Certificate.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -96,7 +96,7 @@
 
     /**
      * Encodes the certificate to an output stream in a format that can
-     * be decoded by the <code>decode</code> method.
+     * be decoded by the {@code decode} method.
      *
      * @param stream the output stream to which to encode the
      * certificate.
@@ -115,8 +115,8 @@
 
     /**
      * Decodes a certificate from an input stream. The format should be
-     * that returned by <code>getFormat</code> and produced by
-     * <code>encode</code>.
+     * that returned by {@code getFormat} and produced by
+     * {@code encode}.
      *
      * @param stream the input stream from which to fetch the data
      * being decoded.
@@ -137,8 +137,8 @@
     /**
      * Returns the name of the coding format. This is used as a hint to find
      * an appropriate parser. It could be "X.509", "PGP", etc. This is
-     * the format produced and understood by the <code>encode</code>
-     * and <code>decode</code> methods.
+     * the format produced and understood by the {@code encode}
+     * and {@code decode} methods.
      *
      * @return the name of the coding format.
      */
diff --git a/ojluni/src/main/java/java/security/CodeSigner.java b/ojluni/src/main/java/java/security/CodeSigner.java
index 0b233d3..37c12b1 100644
--- a/ojluni/src/main/java/java/security/CodeSigner.java
+++ b/ojluni/src/main/java/java/security/CodeSigner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -63,12 +63,12 @@
      * Constructs a CodeSigner object.
      *
      * @param signerCertPath The signer's certificate path.
-     *                       It must not be <code>null</code>.
+     *                       It must not be {@code null}.
      * @param timestamp A signature timestamp.
-     *                  If <code>null</code> then no timestamp was generated
+     *                  If {@code null} then no timestamp was generated
      *                  for the signature.
-     * @throws NullPointerException if <code>signerCertPath</code> is
-     *                              <code>null</code>.
+     * @throws NullPointerException if {@code signerCertPath} is
+     *                              {@code null}.
      */
     public CodeSigner(CertPath signerCertPath, Timestamp timestamp) {
         if (signerCertPath == null) {
@@ -90,7 +90,7 @@
     /**
      * Returns the signature timestamp.
      *
-     * @return The timestamp or <code>null</code> if none is present.
+     * @return The timestamp or {@code null} if none is present.
      */
     public Timestamp getTimestamp() {
         return timestamp;
diff --git a/ojluni/src/main/java/java/security/DigestException.java b/ojluni/src/main/java/java/security/DigestException.java
index 9d44750..2327c98 100644
--- a/ojluni/src/main/java/java/security/DigestException.java
+++ b/ojluni/src/main/java/java/security/DigestException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -55,13 +55,13 @@
     }
 
     /**
-     * Creates a <code>DigestException</code> with the specified
+     * Creates a {@code DigestException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -70,13 +70,13 @@
     }
 
     /**
-     * Creates a <code>DigestException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code DigestException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/DigestInputStream.java b/ojluni/src/main/java/java/security/DigestInputStream.java
index 8aa16dc..a1bf55a 100644
--- a/ojluni/src/main/java/java/security/DigestInputStream.java
+++ b/ojluni/src/main/java/java/security/DigestInputStream.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 1999, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -37,13 +37,13 @@
  * the bits going through the stream.
  *
  * <p>To complete the message digest computation, call one of the
- * <code>digest</code> methods on the associated message
+ * {@code digest} methods on the associated message
  * digest after your calls to one of this digest input stream's
  * {@link #read() read} methods.
  *
  * <p>It is possible to turn this stream on or off (see
  * {@link #on(boolean) on}). When it is on, a call to one of the
- * <code>read</code> methods
+ * {@code read} methods
  * results in an update on the message digest.  But when it is off,
  * the message digest is not updated. The default is for the stream
  * to be on.
@@ -111,7 +111,7 @@
      * function is on).  That is, this method reads a byte from the
      * input stream, blocking until the byte is actually read. If the
      * digest function is on (see {@link #on(boolean) on}), this method
-     * will then call <code>update</code> on the message digest associated
+     * will then call {@code update} on the message digest associated
      * with this stream, passing it the byte read.
      *
      * @return the byte read.
@@ -131,25 +131,25 @@
     /**
      * Reads into a byte array, and updates the message digest (if the
      * digest function is on).  That is, this method reads up to
-     * <code>len</code> bytes from the input stream into the array
-     * <code>b</code>, starting at offset <code>off</code>. This method
+     * {@code len} bytes from the input stream into the array
+     * {@code b}, starting at offset {@code off}. This method
      * blocks until the data is actually
      * read. If the digest function is on (see
-     * {@link #on(boolean) on}), this method will then call <code>update</code>
+     * {@link #on(boolean) on}), this method will then call {@code update}
      * on the message digest associated with this stream, passing it
      * the data.
      *
      * @param b the array into which the data is read.
      *
-     * @param off the starting offset into <code>b</code> of where the
+     * @param off the starting offset into {@code b} of where the
      * data should be placed.
      *
      * @param len the maximum number of bytes to be read from the input
-     * stream into b, starting at offset <code>off</code>.
+     * stream into b, starting at offset {@code off}.
      *
      * @return  the actual number of bytes read. This is less than
-     * <code>len</code> if the end of the stream is reached prior to
-     * reading <code>len</code> bytes. -1 is returned if no bytes were
+     * {@code len} if the end of the stream is reached prior to
+     * reading {@code len} bytes. -1 is returned if no bytes were
      * read because the end of the stream had already been reached when
      * the call was made.
      *
@@ -167,7 +167,7 @@
 
     /**
      * Turns the digest function on or off. The default is on.  When
-     * it is on, a call to one of the <code>read</code> methods results in an
+     * it is on, a call to one of the {@code read} methods results in an
      * update on the message digest.  But when it is off, the message
      * digest is not updated.
      *
diff --git a/ojluni/src/main/java/java/security/GeneralSecurityException.java b/ojluni/src/main/java/java/security/GeneralSecurityException.java
index 60b5688..dc9ea06 100644
--- a/ojluni/src/main/java/java/security/GeneralSecurityException.java
+++ b/ojluni/src/main/java/java/security/GeneralSecurityException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,7 +26,7 @@
 package java.security;
 
 /**
- * The <code>GeneralSecurityException</code> class is a generic
+ * The {@code GeneralSecurityException} class is a generic
  * security exception class that provides type safety for all the
  * security-related exception classes that extend from it.
  *
@@ -57,13 +57,13 @@
     }
 
     /**
-     * Creates a <code>GeneralSecurityException</code> with the specified
+     * Creates a {@code GeneralSecurityException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -72,13 +72,13 @@
     }
 
     /**
-     * Creates a <code>GeneralSecurityException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code GeneralSecurityException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/Guard.java b/ojluni/src/main/java/java/security/Guard.java
index 7cfd25b..abafb58 100644
--- a/ojluni/src/main/java/java/security/Guard.java
+++ b/ojluni/src/main/java/java/security/Guard.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1998, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -29,9 +29,9 @@
  * <p> This interface represents a guard, which is an object that is used
  * to protect access to another object.
  *
- * <p>This interface contains a single method, <code>checkGuard</code>,
- * with a single <code>object</code> argument. <code>checkGuard</code> is
- * invoked (by the GuardedObject <code>getObject</code> method)
+ * <p>This interface contains a single method, {@code checkGuard},
+ * with a single {@code object} argument. {@code checkGuard} is
+ * invoked (by the GuardedObject {@code getObject} method)
  * to determine whether or not to allow access to the object.
  *
  * @see GuardedObject
@@ -44,7 +44,7 @@
 
     /**
      * Determines whether or not to allow access to the guarded object
-     * <code>object</code>. Returns silently if access is allowed.
+     * {@code object}. Returns silently if access is allowed.
      * Otherwise, throws a SecurityException.
      *
      * @param object the object being protected by the guard.
diff --git a/ojluni/src/main/java/java/security/GuardedObject.java b/ojluni/src/main/java/java/security/GuardedObject.java
index c4edb23..a275ddf 100644
--- a/ojluni/src/main/java/java/security/GuardedObject.java
+++ b/ojluni/src/main/java/java/security/GuardedObject.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2004, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -33,9 +33,9 @@
  * such that access to the target object is possible
  * only if the Guard object allows it.
  * Once an object is encapsulated by a GuardedObject,
- * access to that object is controlled by the <code>getObject</code>
+ * access to that object is controlled by the {@code getObject}
  * method, which invokes the
- * <code>checkGuard</code> method on the Guard object that is
+ * {@code checkGuard} method on the Guard object that is
  * guarding access. If access is not allowed,
  * an exception is thrown.
  *
diff --git a/ojluni/src/main/java/java/security/Identity.java b/ojluni/src/main/java/java/security/Identity.java
index 06446b8..e63131e 100644
--- a/ojluni/src/main/java/java/security/Identity.java
+++ b/ojluni/src/main/java/java/security/Identity.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 1996, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -53,9 +53,9 @@
  *
  * @author Benjamin Renaud
  * @deprecated This class is no longer used. Its functionality has been
- * replaced by <code>java.security.KeyStore</code>, the
- * <code>java.security.cert</code> package, and
- * <code>java.security.Principal</code>.
+ * replaced by {@code java.security.KeyStore}, the
+ * {@code java.security.cert} package, and
+ * {@code java.security.Principal}.
  */
 @Deprecated
 public abstract class Identity implements Principal, Serializable {
@@ -165,8 +165,8 @@
      * Sets this identity's public key. The old key and all of this
      * identity's certificates are removed by this operation.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"setIdentityPublicKey"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "setIdentityPublicKey"}
      * as its argument to see if it's ok to set the public key.
      *
      * @param key the public key for this identity.
@@ -175,7 +175,7 @@
      * identity's scope has the same public key, or if another exception occurs.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * setting the public key.
      *
      * @see #getPublicKey
@@ -192,14 +192,14 @@
     /**
      * Specifies a general information string for this identity.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"setIdentityInfo"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "setIdentityInfo"}
      * as its argument to see if it's ok to specify the information string.
      *
      * @param info the information string.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * setting the information string.
      *
      * @see #getInfo
@@ -227,8 +227,8 @@
      * the identity does not have a public key, the identity's
      * public key is set to be that specified in the certificate.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"addIdentityCertificate"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "addIdentityCertificate"}
      * as its argument to see if it's ok to add a certificate.
      *
      * @param certificate the certificate to be added.
@@ -238,7 +238,7 @@
      * this identity's public key, or if another exception occurs.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * adding a certificate.
      *
      * @see SecurityManager#checkSecurityAccess
@@ -262,7 +262,7 @@
         certificates.addElement(certificate);
     }
 
-    private boolean keyEquals(Key aKey, Key anotherKey) {
+    private boolean keyEquals(PublicKey aKey, PublicKey anotherKey) {
         String aKeyFormat = aKey.getFormat();
         String anotherKeyFormat = anotherKey.getFormat();
         if ((aKeyFormat == null) ^ (anotherKeyFormat == null))
@@ -278,8 +278,8 @@
     /**
      * Removes a certificate from this identity.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"removeIdentityCertificate"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "removeIdentityCertificate"}
      * as its argument to see if it's ok to remove a certificate.
      *
      * @param certificate the certificate to be removed.
@@ -288,7 +288,7 @@
      * missing, or if another exception occurs.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * removing a certificate.
      *
      * @see SecurityManager#checkSecurityAccess
@@ -396,15 +396,15 @@
      * Returns a short string describing this identity, telling its
      * name and its scope (if any).
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"printIdentity"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "printIdentity"}
      * as its argument to see if it's ok to return the string.
      *
      * @return information about this identity, such as its name and the
      * name of its scope (if any).
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * returning a string describing this identity.
      *
      * @see SecurityManager#checkSecurityAccess
@@ -421,20 +421,20 @@
     /**
      * Returns a string representation of this identity, with
      * optionally more details than that provided by the
-     * <code>toString</code> method without any arguments.
+     * {@code toString} method without any arguments.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"printIdentity"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "printIdentity"}
      * as its argument to see if it's ok to return the string.
      *
      * @param detailed whether or not to provide detailed information.
      *
-     * @return information about this identity. If <code>detailed</code>
+     * @return information about this identity. If {@code detailed}
      * is true, then this method returns more information than that
-     * provided by the <code>toString</code> method without any arguments.
+     * provided by the {@code toString} method without any arguments.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * returning a string describing this identity.
      *
      * @see #toString
diff --git a/ojluni/src/main/java/java/security/IdentityScope.java b/ojluni/src/main/java/java/security/IdentityScope.java
index b1789a8..65f4e98 100644
--- a/ojluni/src/main/java/java/security/IdentityScope.java
+++ b/ojluni/src/main/java/java/security/IdentityScope.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -58,9 +58,9 @@
  * @author Benjamin Renaud
  *
  * @deprecated This class is no longer used. Its functionality has been
- * replaced by <code>java.security.KeyStore</code>, the
- * <code>java.security.cert</code> package, and
- * <code>java.security.Principal</code>.
+ * replaced by {@code java.security.KeyStore}, the
+ * {@code java.security.cert} package, and
+ * {@code java.security.Principal}.
  */
 @Deprecated
 public abstract
@@ -147,14 +147,14 @@
      * Sets the system's identity scope.
      *
      * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code>
-     * method is called with <code>"setSystemScope"</code>
+     * {@code checkSecurityAccess}
+     * method is called with {@code "setSystemScope"}
      * as its argument to see if it's ok to set the identity scope.
      *
      * @param scope the scope to set.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * setting the identity scope.
      *
      * @see #getSystemScope
@@ -177,8 +177,8 @@
      *
      * @param name the name of the identity to be retrieved.
      *
-     * @return the identity named <code>name</code>, or null if there are
-     * no identities named <code>name</code> in this scope.
+     * @return the identity named {@code name}, or null if there are
+     * no identities named {@code name} in this scope.
      */
     public abstract Identity getIdentity(String name);
 
diff --git a/ojluni/src/main/java/java/security/InvalidAlgorithmParameterException.java b/ojluni/src/main/java/java/security/InvalidAlgorithmParameterException.java
index b4f1a08..559a8be 100644
--- a/ojluni/src/main/java/java/security/InvalidAlgorithmParameterException.java
+++ b/ojluni/src/main/java/java/security/InvalidAlgorithmParameterException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -65,13 +65,13 @@
     }
 
     /**
-     * Creates a <code>InvalidAlgorithmParameterException</code> with the
+     * Creates a {@code InvalidAlgorithmParameterException} with the
      * specified detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -80,14 +80,14 @@
     }
 
     /**
-     * Creates a <code>InvalidAlgorithmParameterException</code> with the
+     * Creates a {@code InvalidAlgorithmParameterException} with the
      * specified cause and a detail message of
-     * <tt>(cause==null ? null : cause.toString())</tt>
+     * {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/InvalidKeyException.java b/ojluni/src/main/java/java/security/InvalidKeyException.java
index e9130f7..35fc64c 100644
--- a/ojluni/src/main/java/java/security/InvalidKeyException.java
+++ b/ojluni/src/main/java/java/security/InvalidKeyException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -58,13 +58,13 @@
     }
 
     /**
-     * Creates a <code>InvalidKeyException</code> with the specified
+     * Creates a {@code InvalidKeyException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -73,13 +73,13 @@
     }
 
     /**
-     * Creates a <code>InvalidKeyException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code InvalidKeyException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/Key.java b/ojluni/src/main/java/java/security/Key.java
index e346b10..c8132f4 100644
--- a/ojluni/src/main/java/java/security/Key.java
+++ b/ojluni/src/main/java/java/security/Key.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -39,7 +39,7 @@
  * RSA), which will work with those algorithms and with related
  * algorithms (such as MD5 with RSA, SHA-1 with RSA, Raw DSA, etc.)
  * The name of the algorithm of a key is obtained using the
- * {@link #getAlgorithm() getAlgorithm} method.<P>
+ * {@link #getAlgorithm() getAlgorithm} method.
  *
  * <LI>An Encoded Form
  *
@@ -47,9 +47,9 @@
  * representation of the key is needed outside the Java Virtual Machine,
  * as when transmitting the key to some other party. The key
  * is encoded according to a standard format (such as
- * X.509 <code>SubjectPublicKeyInfo</code> or PKCS#8), and
+ * X.509 {@code SubjectPublicKeyInfo} or PKCS#8), and
  * is returned using the {@link #getEncoded() getEncoded} method.
- * Note: The syntax of the ASN.1 type <code>SubjectPublicKeyInfo</code>
+ * Note: The syntax of the ASN.1 type {@code SubjectPublicKeyInfo}
  * is defined as follows:
  *
  * <pre>
@@ -65,12 +65,11 @@
  * For more information, see
  * <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
  * Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>.
- * <P>
  *
  * <LI>A Format
  *
  * <P>This is the name of the format of the encoded key. It is returned
- * by the {@link #getFormat() getFormat} method.<P>
+ * by the {@link #getFormat() getFormat} method.
  *
  * </UL>
  *
@@ -132,11 +131,11 @@
      * For example, the name of the ASN.1 data format for public
      * keys is <I>SubjectPublicKeyInfo</I>, as
      * defined by the X.509 standard; in this case, the returned format is
-     * <code>"X.509"</code>. Similarly,
+     * {@code "X.509"}. Similarly,
      * the name of the ASN.1 data format for private keys is
      * <I>PrivateKeyInfo</I>,
      * as defined by the PKCS #8 standard; in this case, the returned format is
-     * <code>"PKCS#8"</code>.
+     * {@code "PKCS#8"}.
      *
      * @return the primary encoding format of the key.
      */
diff --git a/ojluni/src/main/java/java/security/KeyException.java b/ojluni/src/main/java/java/security/KeyException.java
index cd79fcb..59cdd6f 100644
--- a/ojluni/src/main/java/java/security/KeyException.java
+++ b/ojluni/src/main/java/java/security/KeyException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,13 +59,13 @@
     }
 
     /**
-     * Creates a <code>KeyException</code> with the specified
+     * Creates a {@code KeyException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -74,13 +74,13 @@
     }
 
     /**
-     * Creates a <code>KeyException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code KeyException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/KeyFactory.java b/ojluni/src/main/java/java/security/KeyFactory.java
index 865d553..92149ae 100644
--- a/ojluni/src/main/java/java/security/KeyFactory.java
+++ b/ojluni/src/main/java/java/security/KeyFactory.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -37,7 +37,7 @@
 
 /**
  * Key factories are used to convert <I>keys</I> (opaque
- * cryptographic keys of type <code>Key</code>) into <I>key specifications</I>
+ * cryptographic keys of type {@code Key}) into <I>key specifications</I>
  * (transparent representations of the underlying key material), and vice
  * versa.
  *
@@ -47,8 +47,8 @@
  *
  * <P> Multiple compatible key specifications may exist for the same key.
  * For example, a DSA public key may be specified using
- * <code>DSAPublicKeySpec</code> or
- * <code>X509EncodedKeySpec</code>. A key factory can be used to translate
+ * {@code DSAPublicKeySpec} or
+ * {@code X509EncodedKeySpec}. A key factory can be used to translate
  * between compatible key specifications.
  *
  * <P> The following is an example of how to use a key factory in order to
@@ -143,7 +143,7 @@
      * @param keyFacSpi the delegate
      * @param provider the provider
      * @param algorithm the name of the algorithm
-     * to associate with this <tt>KeyFactory</tt>
+     * to associate with this {@code KeyFactory}
      */
     protected KeyFactory(KeyFactorySpi keyFacSpi, Provider provider,
                          String algorithm) {
@@ -289,10 +289,10 @@
 
     /**
      * Gets the name of the algorithm
-     * associated with this <tt>KeyFactory</tt>.
+     * associated with this {@code KeyFactory}.
      *
      * @return the name of the algorithm associated with this
-     * <tt>KeyFactory</tt>
+     * {@code KeyFactory}
      */
     public final String getAlgorithm() {
         return this.algorithm;
@@ -412,11 +412,13 @@
 
     /**
      * Returns a specification (key material) of the given key object.
-     * <code>keySpec</code> identifies the specification class in which
+     * {@code keySpec} identifies the specification class in which
      * the key material should be returned. It could, for example, be
-     * <code>DSAPublicKeySpec.class</code>, to indicate that the
+     * {@code DSAPublicKeySpec.class}, to indicate that the
      * key material should be returned in an instance of the
-     * <code>DSAPublicKeySpec</code> class.
+     * {@code DSAPublicKeySpec} class.
+     *
+     * @param <T> the type of the key specification to be returned
      *
      * @param key the key.
      *
diff --git a/ojluni/src/main/java/java/security/KeyFactorySpi.java b/ojluni/src/main/java/java/security/KeyFactorySpi.java
index f1f4d4a..5ee7f45 100644
--- a/ojluni/src/main/java/java/security/KeyFactorySpi.java
+++ b/ojluni/src/main/java/java/security/KeyFactorySpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2004, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,13 +30,13 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>KeyFactory</code> class.
+ * for the {@code KeyFactory} class.
  * All the abstract methods in this class must be implemented by each
  * cryptographic service provider who wishes to supply the implementation
  * of a key factory for a particular algorithm.
  *
  * <P> Key factories are used to convert <I>keys</I> (opaque
- * cryptographic keys of type <code>Key</code>) into <I>key specifications</I>
+ * cryptographic keys of type {@code Key}) into <I>key specifications</I>
  * (transparent representations of the underlying key material), and vice
  * versa.
  *
@@ -46,8 +46,8 @@
  *
  * <P> Multiple compatible key specifications may exist for the same key.
  * For example, a DSA public key may be specified using
- * <code>DSAPublicKeySpec</code> or
- * <code>X509EncodedKeySpec</code>. A key factory can be used to translate
+ * {@code DSAPublicKeySpec} or
+ * {@code X509EncodedKeySpec}. A key factory can be used to translate
  * between compatible key specifications.
  *
  * <P> A provider should document all the key specifications supported by its
@@ -100,11 +100,13 @@
     /**
      * Returns a specification (key material) of the given key
      * object.
-     * <code>keySpec</code> identifies the specification class in which
+     * {@code keySpec} identifies the specification class in which
      * the key material should be returned. It could, for example, be
-     * <code>DSAPublicKeySpec.class</code>, to indicate that the
+     * {@code DSAPublicKeySpec.class}, to indicate that the
      * key material should be returned in an instance of the
-     * <code>DSAPublicKeySpec</code> class.
+     * {@code DSAPublicKeySpec} class.
+     *
+     * @param <T> the type of the key specification to be returned
      *
      * @param key the key.
      *
diff --git a/ojluni/src/main/java/java/security/KeyManagementException.java b/ojluni/src/main/java/java/security/KeyManagementException.java
index 403e36a..be212b9 100644
--- a/ojluni/src/main/java/java/security/KeyManagementException.java
+++ b/ojluni/src/main/java/java/security/KeyManagementException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -68,13 +68,13 @@
     }
 
     /**
-     * Creates a <code>KeyManagementException</code> with the specified
+     * Creates a {@code KeyManagementException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -83,13 +83,13 @@
     }
 
     /**
-     * Creates a <code>KeyManagementException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code KeyManagementException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/KeyPair.java b/ojluni/src/main/java/java/security/KeyPair.java
index 1681553..6147a16 100644
--- a/ojluni/src/main/java/java/security/KeyPair.java
+++ b/ojluni/src/main/java/java/security/KeyPair.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -50,7 +50,7 @@
      *
      * <p>Note that this constructor only stores references to the public
      * and private key components in the generated key pair. This is safe,
-     * because <code>Key</code> objects are immutable.
+     * because {@code Key} objects are immutable.
      *
      * @param publicKey the public key.
      *
diff --git a/ojluni/src/main/java/java/security/KeyPairGenerator.java b/ojluni/src/main/java/java/security/KeyPairGenerator.java
index 9413d11..cbdaf3e 100644
--- a/ojluni/src/main/java/java/security/KeyPairGenerator.java
+++ b/ojluni/src/main/java/java/security/KeyPairGenerator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2014, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,10 +34,15 @@
 import sun.security.jca.*;
 import sun.security.jca.GetInstance.Instance;
 
+/*
+ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+import sun.security.util.Debug;
+*/
+
 /**
  * The KeyPairGenerator class is used to generate pairs of
  * public and private keys. Key pair generators are constructed using the
- * <code>getInstance</code> factory methods (static methods that
+ * {@code getInstance} factory methods (static methods that
  * return instances of a given class).
  *
  * <p>A Key pair generator for a particular algorithm creates a public/private
@@ -58,50 +63,49 @@
  * {@link #initialize(int, java.security.SecureRandom) initialize}
  * method in this KeyPairGenerator class that takes these two universally
  * shared types of arguments. There is also one that takes just a
- * <code>keysize</code> argument, and uses the <code>SecureRandom</code>
+ * {@code keysize} argument, and uses the {@code SecureRandom}
  * implementation of the highest-priority installed provider as the source
  * of randomness. (If none of the installed providers supply an implementation
- * of <code>SecureRandom</code>, a system-provided source of randomness is
+ * of {@code SecureRandom}, a system-provided source of randomness is
  * used.)
  *
  * <p>Since no other parameters are specified when you call the above
- * algorithm-independent <code>initialize</code> methods, it is up to the
+ * algorithm-independent {@code initialize} methods, it is up to the
  * provider what to do about the algorithm-specific parameters (if any) to be
  * associated with each of the keys.
  *
  * <p>If the algorithm is the <i>DSA</i> algorithm, and the keysize (modulus
  * size) is 512, 768, or 1024, then the <i>Sun</i> provider uses a set of
- * precomputed values for the <code>p</code>, <code>q</code>, and
- * <code>g</code> parameters. If the modulus size is not one of the above
+ * precomputed values for the {@code p}, {@code q}, and
+ * {@code g} parameters. If the modulus size is not one of the above
  * values, the <i>Sun</i> provider creates a new set of parameters. Other
  * providers might have precomputed parameter sets for more than just the
  * three modulus sizes mentioned above. Still others might not have a list of
  * precomputed parameters at all and instead always create new parameter sets.
- * <p>
  *
  * <li><b>Algorithm-Specific Initialization</b>
  * <p>For situations where a set of algorithm-specific parameters already
  * exists (e.g., so-called <i>community parameters</i> in DSA), there are two
  * {@link #initialize(java.security.spec.AlgorithmParameterSpec)
- * initialize} methods that have an <code>AlgorithmParameterSpec</code>
- * argument. One also has a <code>SecureRandom</code> argument, while the
- * the other uses the <code>SecureRandom</code>
+ * initialize} methods that have an {@code AlgorithmParameterSpec}
+ * argument. One also has a {@code SecureRandom} argument, while the
+ * the other uses the {@code SecureRandom}
  * implementation of the highest-priority installed provider as the source
  * of randomness. (If none of the installed providers supply an implementation
- * of <code>SecureRandom</code>, a system-provided source of randomness is
+ * of {@code SecureRandom}, a system-provided source of randomness is
  * used.)
  * </ul>
  *
  * <p>In case the client does not explicitly initialize the KeyPairGenerator
- * (via a call to an <code>initialize</code> method), each provider must
+ * (via a call to an {@code initialize} method), each provider must
  * supply (and document) a default initialization.
  * For example, the <i>Sun</i> provider uses a default modulus size (keysize)
  * of 1024 bits.
  *
  * <p>Note that this class is abstract and extends from
- * <code>KeyPairGeneratorSpi</code> for historical reasons.
+ * {@code KeyPairGeneratorSpi} for historical reasons.
  * Application developers should only take notice of the methods defined in
- * this <code>KeyPairGenerator</code> class; all the methods in
+ * this {@code KeyPairGenerator} class; all the methods in
  * the superclass are intended for cryptographic service providers who wish to
  * supply their own implementations of key pair generators.
  *
@@ -145,6 +149,14 @@
 
 public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
 
+    /*
+    ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+    private static final Debug pdebug =
+                        Debug.getInstance("provider", "Provider");
+    private static final boolean skipDebug =
+        Debug.isOn("engine=") && !Debug.isOn("keypairgenerator");
+    */
+
     private final String algorithm;
 
     // The provider
@@ -186,6 +198,15 @@
             kpg = new Delegate(spi, algorithm);
         }
         kpg.provider = instance.provider;
+
+        /*
+        ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+        if (!skipDebug && pdebug != null) {
+            pdebug.println("KeyPairGenerator." + algorithm +
+                " algorithm from: " + kpg.provider.getName());
+        }
+        */
+
         return kpg;
     }
 
@@ -340,18 +361,18 @@
 
     /**
      * Initializes the key pair generator for a certain keysize using
-     * a default parameter set and the <code>SecureRandom</code>
+     * a default parameter set and the {@code SecureRandom}
      * implementation of the highest-priority installed provider as the source
      * of randomness.
      * (If none of the installed providers supply an implementation of
-     * <code>SecureRandom</code>, a system-provided source of randomness is
+     * {@code SecureRandom}, a system-provided source of randomness is
      * used.)
      *
      * @param keysize the keysize. This is an
      * algorithm-specific metric, such as modulus length, specified in
      * number of bits.
      *
-     * @exception InvalidParameterException if the <code>keysize</code> is not
+     * @exception InvalidParameterException if the {@code keysize} is not
      * supported by this KeyPairGenerator object.
      */
     public void initialize(int keysize) {
@@ -367,7 +388,7 @@
      * number of bits.
      * @param random the source of randomness.
      *
-     * @exception InvalidParameterException if the <code>keysize</code> is not
+     * @exception InvalidParameterException if the {@code keysize} is not
      * supported by this KeyPairGenerator object.
      *
      * @since 1.2
@@ -387,11 +408,11 @@
 
     /**
      * Initializes the key pair generator using the specified parameter
-     * set and the <code>SecureRandom</code>
+     * set and the {@code SecureRandom}
      * implementation of the highest-priority installed provider as the source
      * of randomness.
      * (If none of the installed providers supply an implementation of
-     * <code>SecureRandom</code>, a system-provided source of randomness is
+     * {@code SecureRandom}, a system-provided source of randomness is
      * used.).
      *
      * <p>This concrete method has been added to this previously-defined
@@ -400,10 +421,10 @@
      * {@link KeyPairGeneratorSpi#initialize(
      * java.security.spec.AlgorithmParameterSpec,
      * java.security.SecureRandom) initialize} method,
-     * passing it <code>params</code> and a source of randomness (obtained
+     * passing it {@code params} and a source of randomness (obtained
      * from the highest-priority installed provider or system-provided if none
      * of the installed providers supply one).
-     * That <code>initialize</code> method always throws an
+     * That {@code initialize} method always throws an
      * UnsupportedOperationException if it is not overridden by the provider.
      *
      * @param params the parameter set used to generate the keys.
@@ -428,8 +449,8 @@
      * KeyPairGeneratorSpi#initialize(
      * java.security.spec.AlgorithmParameterSpec,
      * java.security.SecureRandom) initialize} method,
-     * passing it <code>params</code> and <code>random</code>.
-     * That <code>initialize</code>
+     * passing it {@code params} and {@code random}.
+     * That {@code initialize}
      * method always throws an
      * UnsupportedOperationException if it is not overridden by the provider.
      *
@@ -576,6 +597,14 @@
             provider = instance.provider;
             this.serviceIterator = serviceIterator;
             initType = I_NONE;
+
+            /*
+            ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+            if (!skipDebug && pdebug != null) {
+                pdebug.println("KeyPairGenerator." + algorithm +
+                    " algorithm from: " + provider.getName());
+            }
+            */
         }
 
         /**
diff --git a/ojluni/src/main/java/java/security/KeyPairGeneratorSpi.java b/ojluni/src/main/java/java/security/KeyPairGeneratorSpi.java
index 28139ad..dfe8c04 100644
--- a/ojluni/src/main/java/java/security/KeyPairGeneratorSpi.java
+++ b/ojluni/src/main/java/java/security/KeyPairGeneratorSpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1999, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -29,7 +29,7 @@
 
 /**
  * <p> This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>KeyPairGenerator</code> class, which is used to generate
+ * for the {@code KeyPairGenerator} class, which is used to generate
  * pairs of public and private keys.
  *
  * <p> All the abstract methods in this class must be implemented by each
@@ -37,7 +37,7 @@
  * of a key pair generator for a particular algorithm.
  *
  * <p> In case the client does not explicitly initialize the KeyPairGenerator
- * (via a call to an <code>initialize</code> method), each provider must
+ * (via a call to an {@code initialize} method), each provider must
  * supply (and document) a default initialization.
  * For example, the <i>Sun</i> provider uses a default modulus size (keysize)
  * of 1024 bits.
@@ -61,7 +61,7 @@
      *
      * @param random the source of randomness for this generator.
      *
-     * @exception InvalidParameterException if the <code>keysize</code> is not
+     * @exception InvalidParameterException if the {@code keysize} is not
      * supported by this KeyPairGeneratorSpi object.
      */
     public abstract void initialize(int keysize, SecureRandom random);
@@ -100,7 +100,7 @@
      * will be used. This will generate a new key pair every time it
      * is called.
      *
-     * @return the newly generated <tt>KeyPair</tt>
+     * @return the newly generated {@code KeyPair}
      */
     public abstract KeyPair generateKeyPair();
 }
diff --git a/ojluni/src/main/java/java/security/KeyRep.java b/ojluni/src/main/java/java/security/KeyRep.java
index 80a9b03..97a6c16 100644
--- a/ojluni/src/main/java/java/security/KeyRep.java
+++ b/ojluni/src/main/java/java/security/KeyRep.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 package java.security;
 
 import java.io.*;
+import java.util.Locale;
 
 import java.security.spec.PKCS8EncodedKeySpec;
 import java.security.spec.X509EncodedKeySpec;
@@ -115,17 +116,17 @@
      *
      * @param type either one of Type.SECRET, Type.PUBLIC, or Type.PRIVATE
      * @param algorithm the algorithm returned from
-     *          <code>Key.getAlgorithm()</code>
+     *          {@code Key.getAlgorithm()}
      * @param format the encoding format returned from
-     *          <code>Key.getFormat()</code>
+     *          {@code Key.getFormat()}
      * @param encoded the encoded bytes returned from
-     *          <code>Key.getEncoded()</code>
+     *          {@code Key.getEncoded()}
      *
      * @exception NullPointerException
-     *          if type is <code>null</code>,
-     *          if algorithm is <code>null</code>,
-     *          if format is <code>null</code>,
-     *          or if encoded is <code>null</code>
+     *          if type is {@code null},
+     *          if algorithm is {@code null},
+     *          if format is {@code null},
+     *          or if encoded is {@code null}
      */
     public KeyRep(Type type, String algorithm,
                 String format, byte[] encoded) {
@@ -137,7 +138,7 @@
 
         this.type = type;
         this.algorithm = algorithm;
-        this.format = format.toUpperCase();
+        this.format = format.toUpperCase(Locale.ENGLISH);
         this.encoded = encoded.clone();
     }
 
diff --git a/ojluni/src/main/java/java/security/KeyStoreException.java b/ojluni/src/main/java/java/security/KeyStoreException.java
index 707a558..cf56d6a 100644
--- a/ojluni/src/main/java/java/security/KeyStoreException.java
+++ b/ojluni/src/main/java/java/security/KeyStoreException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,13 +59,13 @@
     }
 
     /**
-     * Creates a <code>KeyStoreException</code> with the specified
+     * Creates a {@code KeyStoreException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -74,13 +74,13 @@
     }
 
     /**
-     * Creates a <code>KeyStoreException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code KeyStoreException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/KeyStoreSpi.java b/ojluni/src/main/java/java/security/KeyStoreSpi.java
index 4035782..4caa59c 100644
--- a/ojluni/src/main/java/java/security/KeyStoreSpi.java
+++ b/ojluni/src/main/java/java/security/KeyStoreSpi.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 1998, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,7 +38,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>KeyStore</code> class.
+ * for the {@code KeyStore} class.
  * All the abstract methods in this class must be implemented by each
  * cryptographic service provider who wishes to supply the implementation
  * of a keystore for a particular keystore type.
@@ -56,9 +56,9 @@
     /**
      * Returns the key associated with the given alias, using the given
      * password to recover it.  The key must have been associated with
-     * the alias by a call to <code>setKeyEntry</code>,
-     * or by a call to <code>setEntry</code> with a
-     * <code>PrivateKeyEntry</code> or <code>SecretKeyEntry</code>.
+     * the alias by a call to {@code setKeyEntry},
+     * or by a call to {@code setEntry} with a
+     * {@code PrivateKeyEntry} or {@code SecretKeyEntry}.
      *
      * @param alias the alias name
      * @param password the password for recovering the key
@@ -77,9 +77,9 @@
     /**
      * Returns the certificate chain associated with the given alias.
      * The certificate chain must have been associated with the alias
-     * by a call to <code>setKeyEntry</code>,
-     * or by a call to <code>setEntry</code> with a
-     * <code>PrivateKeyEntry</code>.
+     * by a call to {@code setKeyEntry},
+     * or by a call to {@code setEntry} with a
+     * {@code PrivateKeyEntry}.
      *
      * @param alias the alias name
      *
@@ -93,15 +93,15 @@
      * Returns the certificate associated with the given alias.
      *
      * <p> If the given alias name identifies an entry
-     * created by a call to <code>setCertificateEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>TrustedCertificateEntry</code>,
+     * created by a call to {@code setCertificateEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code TrustedCertificateEntry},
      * then the trusted certificate contained in that entry is returned.
      *
      * <p> If the given alias name identifies an entry
-     * created by a call to <code>setKeyEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>PrivateKeyEntry</code>,
+     * created by a call to {@code setKeyEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code PrivateKeyEntry},
      * then the first element of the certificate chain in that entry
      * (if a chain exists) is returned.
      *
@@ -126,7 +126,7 @@
      * Assigns the given key to the given alias, protecting it with the given
      * password.
      *
-     * <p>If the given key is of type <code>java.security.PrivateKey</code>,
+     * <p>If the given key is of type {@code java.security.PrivateKey},
      * it must be accompanied by a certificate chain certifying the
      * corresponding public key.
      *
@@ -139,7 +139,7 @@
      * @param password the password to protect the key
      * @param chain the certificate chain for the corresponding public
      * key (only required if the given key is of type
-     * <code>java.security.PrivateKey</code>).
+     * {@code java.security.PrivateKey}).
      *
      * @exception KeyStoreException if the given key cannot be protected, or
      * this operation fails for some other reason
@@ -154,7 +154,7 @@
      * alias.
      *
      * <p>If the protected key is of type
-     * <code>java.security.PrivateKey</code>,
+     * {@code java.security.PrivateKey},
      * it must be accompanied by a certificate chain certifying the
      * corresponding public key.
      *
@@ -166,7 +166,7 @@
      * @param key the key (in protected format) to be associated with the alias
      * @param chain the certificate chain for the corresponding public
      * key (only useful if the protected key is of type
-     * <code>java.security.PrivateKey</code>).
+     * {@code java.security.PrivateKey}).
      *
      * @exception KeyStoreException if this operation fails.
      */
@@ -178,9 +178,9 @@
      * Assigns the given certificate to the given alias.
      *
      * <p> If the given alias identifies an existing entry
-     * created by a call to <code>setCertificateEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>TrustedCertificateEntry</code>,
+     * created by a call to {@code setCertificateEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code TrustedCertificateEntry},
      * the trusted certificate in the existing entry
      * is overridden by the given certificate.
      *
@@ -230,9 +230,9 @@
 
     /**
      * Returns true if the entry identified by the given alias
-     * was created by a call to <code>setKeyEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>PrivateKeyEntry</code> or a <code>SecretKeyEntry</code>.
+     * was created by a call to {@code setKeyEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code PrivateKeyEntry} or a {@code SecretKeyEntry}.
      *
      * @param alias the alias for the keystore entry to be checked
      *
@@ -243,9 +243,9 @@
 
     /**
      * Returns true if the entry identified by the given alias
-     * was created by a call to <code>setCertificateEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>TrustedCertificateEntry</code>.
+     * was created by a call to {@code setCertificateEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code TrustedCertificateEntry}.
      *
      * @param alias the alias for the keystore entry to be checked
      *
@@ -260,15 +260,15 @@
      *
      * <p>This method attempts to match the given certificate with each
      * keystore entry. If the entry being considered was
-     * created by a call to <code>setCertificateEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>TrustedCertificateEntry</code>,
+     * created by a call to {@code setCertificateEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code TrustedCertificateEntry},
      * then the given certificate is compared to that entry's certificate.
      *
      * <p> If the entry being considered was
-     * created by a call to <code>setKeyEntry</code>,
-     * or created by a call to <code>setEntry</code> with a
-     * <code>PrivateKeyEntry</code>,
+     * created by a call to {@code setKeyEntry},
+     * or created by a call to {@code setEntry} with a
+     * {@code PrivateKeyEntry},
      * then the given certificate is compared to the first
      * element of that entry's certificate chain.
      *
@@ -297,14 +297,14 @@
 
     /**
      * Stores this keystore using the given
-     * <code>KeyStore.LoadStoreParmeter</code>.
+     * {@code KeyStore.LoadStoreParmeter}.
      *
-     * @param param the <code>KeyStore.LoadStoreParmeter</code>
+     * @param param the {@code KeyStore.LoadStoreParmeter}
      *          that specifies how to store the keystore,
-     *          which may be <code>null</code>
+     *          which may be {@code null}
      *
      * @exception IllegalArgumentException if the given
-     *          <code>KeyStore.LoadStoreParmeter</code>
+     *          {@code KeyStore.LoadStoreParmeter}
      *          input is not recognized
      * @exception IOException if there was an I/O problem with data
      * @exception NoSuchAlgorithmException if the appropriate data integrity
@@ -330,17 +330,17 @@
      * then integrity checking is not performed.
      *
      * @param stream the input stream from which the keystore is loaded,
-     * or <code>null</code>
+     * or {@code null}
      * @param password the password used to check the integrity of
      * the keystore, the password used to unlock the keystore,
-     * or <code>null</code>
+     * or {@code null}
      *
      * @exception IOException if there is an I/O or format problem with the
      * keystore data, if a password is required but not given,
      * or if the given password was incorrect. If the error is due to a
      * wrong password, the {@link Throwable#getCause cause} of the
-     * <code>IOException</code> should be an
-     * <code>UnrecoverableKeyException</code>
+     * {@code IOException} should be an
+     * {@code UnrecoverableKeyException}
      * @exception NoSuchAlgorithmException if the algorithm used to check
      * the integrity of the keystore cannot be found
      * @exception CertificateException if any of the certificates in the
@@ -351,24 +351,24 @@
 
     /**
      * Loads the keystore using the given
-     * <code>KeyStore.LoadStoreParameter</code>.
+     * {@code KeyStore.LoadStoreParameter}.
      *
      * <p> Note that if this KeyStore has already been loaded, it is
      * reinitialized and loaded again from the given parameter.
      *
-     * @param param the <code>KeyStore.LoadStoreParameter</code>
+     * @param param the {@code KeyStore.LoadStoreParameter}
      *          that specifies how to load the keystore,
-     *          which may be <code>null</code>
+     *          which may be {@code null}
      *
      * @exception IllegalArgumentException if the given
-     *          <code>KeyStore.LoadStoreParameter</code>
+     *          {@code KeyStore.LoadStoreParameter}
      *          input is not recognized
      * @exception IOException if there is an I/O or format problem with the
      *          keystore data. If the error is due to an incorrect
-     *         <code>ProtectionParameter</code> (e.g. wrong password)
+     *         {@code ProtectionParameter} (e.g. wrong password)
      *         the {@link Throwable#getCause cause} of the
-     *         <code>IOException</code> should be an
-     *         <code>UnrecoverableKeyException</code>
+     *         {@code IOException} should be an
+     *         {@code UnrecoverableKeyException}
      * @exception NoSuchAlgorithmException if the algorithm used to check
      *          the integrity of the keystore cannot be found
      * @exception CertificateException if any of the certificates in the
@@ -419,25 +419,25 @@
     }
 
     /**
-     * Gets a <code>KeyStore.Entry</code> for the specified alias
+     * Gets a {@code KeyStore.Entry} for the specified alias
      * with the specified protection parameter.
      *
-     * @param alias get the <code>KeyStore.Entry</code> for this alias
-     * @param protParam the <code>ProtectionParameter</code>
-     *          used to protect the <code>Entry</code>,
-     *          which may be <code>null</code>
+     * @param alias get the {@code KeyStore.Entry} for this alias
+     * @param protParam the {@code ProtectionParameter}
+     *          used to protect the {@code Entry},
+     *          which may be {@code null}
      *
-     * @return the <code>KeyStore.Entry</code> for the specified alias,
-     *          or <code>null</code> if there is no such entry
+     * @return the {@code KeyStore.Entry} for the specified alias,
+     *          or {@code null} if there is no such entry
      *
      * @exception KeyStoreException if the operation failed
      * @exception NoSuchAlgorithmException if the algorithm for recovering the
      *          entry cannot be found
      * @exception UnrecoverableEntryException if the specified
-     *          <code>protParam</code> were insufficient or invalid
+     *          {@code protParam} were insufficient or invalid
      * @exception UnrecoverableKeyException if the entry is a
-     *          <code>PrivateKeyEntry</code> or <code>SecretKeyEntry</code>
-     *          and the specified <code>protParam</code> does not contain
+     *          {@code PrivateKeyEntry} or {@code SecretKeyEntry}
+     *          and the specified {@code protParam} does not contain
      *          the information needed to recover the key (e.g. wrong password)
      *
      * @since 1.5
@@ -483,18 +483,18 @@
     }
 
     /**
-     * Saves a <code>KeyStore.Entry</code> under the specified alias.
+     * Saves a {@code KeyStore.Entry} under the specified alias.
      * The specified protection parameter is used to protect the
-     * <code>Entry</code>.
+     * {@code Entry}.
      *
      * <p> If an entry already exists for the specified alias,
      * it is overridden.
      *
-     * @param alias save the <code>KeyStore.Entry</code> under this alias
-     * @param entry the <code>Entry</code> to save
-     * @param protParam the <code>ProtectionParameter</code>
-     *          used to protect the <code>Entry</code>,
-     *          which may be <code>null</code>
+     * @param alias save the {@code KeyStore.Entry} under this alias
+     * @param entry the {@code Entry} to save
+     * @param protParam the {@code ProtectionParameter}
+     *          used to protect the {@code Entry},
+     *          which may be {@code null}
      *
      * @exception KeyStoreException if this operation fails
      *
@@ -542,16 +542,16 @@
     }
 
     /**
-     * Determines if the keystore <code>Entry</code> for the specified
-     * <code>alias</code> is an instance or subclass of the specified
-     * <code>entryClass</code>.
+     * Determines if the keystore {@code Entry} for the specified
+     * {@code alias} is an instance or subclass of the specified
+     * {@code entryClass}.
      *
      * @param alias the alias name
      * @param entryClass the entry class
      *
-     * @return true if the keystore <code>Entry</code> for the specified
-     *          <code>alias</code> is an instance or subclass of the
-     *          specified <code>entryClass</code>, false otherwise
+     * @return true if the keystore {@code Entry} for the specified
+     *          {@code alias} is an instance or subclass of the
+     *          specified {@code entryClass}, false otherwise
      *
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/MessageDigest.java b/ojluni/src/main/java/java/security/MessageDigest.java
index ff7f544..11dae4b 100644
--- a/ojluni/src/main/java/java/security/MessageDigest.java
+++ b/ojluni/src/main/java/java/security/MessageDigest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -35,6 +35,10 @@
 
 import java.nio.ByteBuffer;
 
+/*
+ANDROID-REMOVED: this debugging mechanism is not available in Android.
+import sun.security.util.Debug;
+*/
 /**
  * This MessageDigest class provides applications the functionality of a
  * message digest algorithm, such as SHA-1 or SHA-256.
@@ -48,36 +52,36 @@
  * updated, one of the {@link #digest() digest} methods should
  * be called to complete the hash computation.
  *
- * <p>The <code>digest</code> method can be called once for a given number
- * of updates. After <code>digest</code> has been called, the MessageDigest
+ * <p>The {@code digest} method can be called once for a given number
+ * of updates. After {@code digest} has been called, the MessageDigest
  * object is reset to its initialized state.
  *
  * <p>Implementations are free to implement the Cloneable interface.
  * Client applications can test cloneability by attempting cloning
- * and catching the CloneNotSupportedException: <p>
+ * and catching the CloneNotSupportedException:
  *
-* <pre>
-* MessageDigest md = MessageDigest.getInstance("SHA");
-*
-* try {
-*     md.update(toChapter1);
-*     MessageDigest tc1 = md.clone();
-*     byte[] toChapter1Digest = tc1.digest();
-*     md.update(toChapter2);
-*     ...etc.
-* } catch (CloneNotSupportedException cnse) {
-*     throw new DigestException("couldn't make digest of partial content");
-* }
-* </pre>
+ * <pre>{@code
+ * MessageDigest md = MessageDigest.getInstance("SHA");
+ *
+ * try {
+ *     md.update(toChapter1);
+ *     MessageDigest tc1 = md.clone();
+ *     byte[] toChapter1Digest = tc1.digest();
+ *     md.update(toChapter2);
+ *     ...etc.
+ * } catch (CloneNotSupportedException cnse) {
+ *     throw new DigestException("couldn't make digest of partial content");
+ * }
+ * }</pre>
  *
  * <p>Note that if a given implementation is not cloneable, it is
  * still possible to compute intermediate digests by instantiating
  * several instances, if the number of digests is known in advance.
  *
  * <p>Note that this class is abstract and extends from
- * <code>MessageDigestSpi</code> for historical reasons.
+ * {@code MessageDigestSpi} for historical reasons.
  * Application developers should only take notice of the methods defined in
- * this <code>MessageDigest</code> class; all the methods in
+ * this {@code MessageDigest} class; all the methods in
  * the superclass are intended for cryptographic service providers who wish to
  * supply their own implementations of message digest algorithms.
  *
@@ -130,6 +134,14 @@
 
 public abstract class MessageDigest extends MessageDigestSpi {
 
+    /*
+    ANDROID-REMOVED: this debugging mechanism is not available in Android.
+    private static final Debug pdebug =
+                        Debug.getInstance("provider", "Provider");
+    private static final boolean skipDebug =
+        Debug.isOn("engine=") && !Debug.isOn("messagedigest");
+    */
+
     private String algorithm;
 
     // The state of this digest
@@ -183,18 +195,26 @@
     public static MessageDigest getInstance(String algorithm)
     throws NoSuchAlgorithmException {
         try {
+            MessageDigest md;
             Object[] objs = Security.getImpl(algorithm, "MessageDigest",
                                              (String)null);
             if (objs[0] instanceof MessageDigest) {
-                MessageDigest md = (MessageDigest)objs[0];
-                md.provider = (Provider)objs[1];
-                return md;
+                md = (MessageDigest)objs[0];
             } else {
-                MessageDigest delegate =
-                    new Delegate((MessageDigestSpi)objs[0], algorithm);
-                delegate.provider = (Provider)objs[1];
-                return delegate;
+                md = new Delegate((MessageDigestSpi)objs[0], algorithm);
             }
+            md.provider = (Provider)objs[1];
+
+            /*
+            ANDROID-REMOVED: this debugging mechanism is not available in Android.
+            if (!skipDebug && pdebug != null) {
+                pdebug.println("MessageDigest." + algorithm +
+                    " algorithm from: " + md.provider.getName());
+            }
+            */
+
+            return md;
+
         } catch(NoSuchProviderException e) {
             throw new NoSuchAlgorithmException(algorithm + " not found");
         }
@@ -328,7 +348,7 @@
      * @param offset the offset to start from in the array of bytes.
      *
      * @param len the number of bytes to use, starting at
-     * <code>offset</code>.
+     * {@code offset}.
      */
     public void update(byte[] input, int offset, int len) {
         if (input == null) {
@@ -353,8 +373,8 @@
 
     /**
      * Update the digest using the specified ByteBuffer. The digest is
-     * updated using the <code>input.remaining()</code> bytes starting
-     * at <code>input.position()</code>.
+     * updated using the {@code input.remaining()} bytes starting
+     * at {@code input.position()}.
      * Upon return, the buffer's position will be equal to its limit;
      * its limit will not have changed.
      *
@@ -392,7 +412,7 @@
      *
      * @param len number of bytes within buf allotted for the digest
      *
-     * @return the number of bytes placed into <code>buf</code>
+     * @return the number of bytes placed into {@code buf}
      *
      * @exception DigestException if an error occurs.
      */
@@ -413,7 +433,7 @@
      * Performs a final update on the digest using the specified array
      * of bytes, then completes the digest computation. That is, this
      * method first calls {@link #update(byte[]) update(input)},
-     * passing the <i>input</i> array to the <code>update</code> method,
+     * passing the <i>input</i> array to the {@code update} method,
      * then calls {@link #digest() digest()}.
      *
      * @param input the input to be updated before the digest is
@@ -458,6 +478,10 @@
      * @return true if the digests are equal, false otherwise.
      */
     public static boolean isEqual(byte[] digesta, byte[] digestb) {
+        if (digesta == digestb) return true;
+        if (digesta == null || digestb == null) {
+            return false;
+        }
         if (digesta.length != digestb.length) {
             return false;
         }
@@ -522,7 +546,7 @@
      * @return a clone if the implementation is cloneable.
      *
      * @exception CloneNotSupportedException if this is called on an
-     * implementation that does not support <code>Cloneable</code>.
+     * implementation that does not support {@code Cloneable}.
      */
     public Object clone() throws CloneNotSupportedException {
         if (this instanceof Cloneable) {
@@ -566,7 +590,7 @@
          * @return a clone if the delegate is cloneable.
          *
          * @exception CloneNotSupportedException if this is called on a
-         * delegate that does not support <code>Cloneable</code>.
+         * delegate that does not support {@code Cloneable}.
          */
         public Object clone() throws CloneNotSupportedException {
             if (digestSpi instanceof Cloneable) {
diff --git a/ojluni/src/main/java/java/security/MessageDigestSpi.java b/ojluni/src/main/java/java/security/MessageDigestSpi.java
index 700d725..0d5ace1 100644
--- a/ojluni/src/main/java/java/security/MessageDigestSpi.java
+++ b/ojluni/src/main/java/java/security/MessageDigestSpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>MessageDigest</code> class, which provides the functionality
+ * for the {@code MessageDigest} class, which provides the functionality
  * of a message digest algorithm, such as MD5 or SHA. Message digests are
  * secure one-way hash functions that take arbitrary-sized data and output a
  * fixed-length hash value.
@@ -88,14 +88,14 @@
      * @param offset the offset to start from in the array of bytes.
      *
      * @param len the number of bytes to use, starting at
-     * <code>offset</code>.
+     * {@code offset}.
      */
     protected abstract void engineUpdate(byte[] input, int offset, int len);
 
     /**
      * Update the digest using the specified ByteBuffer. The digest is
-     * updated using the <code>input.remaining()</code> bytes starting
-     * at <code>input.position()</code>.
+     * updated using the {@code input.remaining()} bytes starting
+     * at {@code input.position()}.
      * Upon return, the buffer's position will be equal to its limit;
      * its limit will not have changed.
      *
@@ -130,7 +130,7 @@
 
     /**
      * Completes the hash computation by performing final
-     * operations such as padding. Once <code>engineDigest</code> has
+     * operations such as padding. Once {@code engineDigest} has
      * been called, the engine should be reset (see
      * {@link #engineReset() engineReset}).
      * Resetting is the responsibility of the
@@ -142,7 +142,7 @@
 
     /**
      * Completes the hash computation by performing final
-     * operations such as padding. Once <code>engineDigest</code> has
+     * operations such as padding. Once {@code engineDigest} has
      * been called, the engine should be reset (see
      * {@link #engineReset() engineReset}).
      * Resetting is the responsibility of the
@@ -194,7 +194,7 @@
      * @return a clone if the implementation is cloneable.
      *
      * @exception CloneNotSupportedException if this is called on an
-     * implementation that does not support <code>Cloneable</code>.
+     * implementation that does not support {@code Cloneable}.
      */
     public Object clone() throws CloneNotSupportedException {
         if (this instanceof Cloneable) {
diff --git a/ojluni/src/main/java/java/security/PolicySpi.java b/ojluni/src/main/java/java/security/PolicySpi.java
index aa66ba8..608ce1f 100644
--- a/ojluni/src/main/java/java/security/PolicySpi.java
+++ b/ojluni/src/main/java/java/security/PolicySpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -28,15 +28,15 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>Policy</code> class.
+ * for the {@code Policy} class.
  * All the abstract methods in this class must be implemented by each
  * service provider who wishes to supply a Policy implementation.
  *
  * <p> Subclass implementations of this abstract class must provide
- * a public constructor that takes a <code>Policy.Parameters</code>
+ * a public constructor that takes a {@code Policy.Parameters}
  * object as an input parameter.  This constructor also must throw
  * an IllegalArgumentException if it does not understand the
- * <code>Policy.Parameters</code> input.
+ * {@code Policy.Parameters} input.
  *
  *
  * @since 1.6
@@ -59,7 +59,7 @@
 
     /**
      * Refreshes/reloads the policy configuration. The behavior of this method
-     * depends on the implementation. For example, calling <code>refresh</code>
+     * depends on the implementation. For example, calling {@code refresh}
      * on a file-based policy will cause the file to be re-read.
      *
      * <p> The default implementation of this method does nothing.
diff --git a/ojluni/src/main/java/java/security/ProviderException.java b/ojluni/src/main/java/java/security/ProviderException.java
index 449c8c3..b372ee7 100644
--- a/ojluni/src/main/java/java/security/ProviderException.java
+++ b/ojluni/src/main/java/java/security/ProviderException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -58,13 +58,13 @@
     }
 
     /**
-     * Creates a <code>ProviderException</code> with the specified
+     * Creates a {@code ProviderException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -73,13 +73,13 @@
     }
 
     /**
-     * Creates a <code>ProviderException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code ProviderException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/PublicKey.java b/ojluni/src/main/java/java/security/PublicKey.java
index c983ff6..df49807 100644
--- a/ojluni/src/main/java/java/security/PublicKey.java
+++ b/ojluni/src/main/java/java/security/PublicKey.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2001, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@
  *
  * Note: The specialized public key interfaces extend this interface.
  * See, for example, the DSAPublicKey interface in
- * <code>java.security.interfaces</code>.
+ * {@code java.security.interfaces}.
  *
  * @see Key
  * @see PrivateKey
diff --git a/ojluni/src/main/java/java/security/SecureClassLoader.java b/ojluni/src/main/java/java/security/SecureClassLoader.java
index ffcd1a7..145f4fc 100644
--- a/ojluni/src/main/java/java/security/SecureClassLoader.java
+++ b/ojluni/src/main/java/java/security/SecureClassLoader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -63,12 +63,12 @@
      * class loader for delegation.
      *
      * <p>If there is a security manager, this method first
-     * calls the security manager's <code>checkCreateClassLoader</code>
+     * calls the security manager's {@code checkCreateClassLoader}
      * method  to ensure creation of a class loader is allowed.
      * <p>
      * @param parent the parent ClassLoader
      * @exception  SecurityException  if a security manager exists and its
-     *             <code>checkCreateClassLoader</code> method doesn't allow
+     *             {@code checkCreateClassLoader} method doesn't allow
      *             creation of a class loader.
      * @see SecurityManager#checkCreateClassLoader
      */
@@ -87,11 +87,11 @@
      * loader for delegation.
      *
      * <p>If there is a security manager, this method first
-     * calls the security manager's <code>checkCreateClassLoader</code>
+     * calls the security manager's {@code checkCreateClassLoader}
      * method  to ensure creation of a class loader is allowed.
      *
      * @exception  SecurityException  if a security manager exists and its
-     *             <code>checkCreateClassLoader</code> method doesn't allow
+     *             {@code checkCreateClassLoader} method doesn't allow
      *             creation of a class loader.
      * @see SecurityManager#checkCreateClassLoader
      */
@@ -113,22 +113,22 @@
      * If a non-null CodeSource is supplied a ProtectionDomain is
      * constructed and associated with the class being defined.
      * <p>
-     * @param      name the expected name of the class, or <code>null</code>
+     * @param      name the expected name of the class, or {@code null}
      *                  if not known, using '.' and not '/' as the separator
      *                  and without a trailing ".class" suffix.
      * @param      b    the bytes that make up the class data. The bytes in
-     *             positions <code>off</code> through <code>off+len-1</code>
+     *             positions {@code off} through {@code off+len-1}
      *             should have the format of a valid class file as defined by
      *             <cite>The Java&trade; Virtual Machine Specification</cite>.
-     * @param      off  the start offset in <code>b</code> of the class data
+     * @param      off  the start offset in {@code b} of the class data
      * @param      len  the length of the class data
-     * @param      cs   the associated CodeSource, or <code>null</code> if none
-     * @return the <code>Class</code> object created from the data,
+     * @param      cs   the associated CodeSource, or {@code null} if none
+     * @return the {@code Class} object created from the data,
      *         and optional CodeSource.
      * @exception  ClassFormatError if the data did not contain a valid class
-     * @exception  IndexOutOfBoundsException if either <code>off</code> or
-     *             <code>len</code> is negative, or if
-     *             <code>off+len</code> is greater than <code>b.length</code>.
+     * @exception  IndexOutOfBoundsException if either {@code off} or
+     *             {@code len} is negative, or if
+     *             {@code off+len} is greater than {@code b.length}.
      *
      * @exception  SecurityException if an attempt is made to add this class
      *             to a package that contains classes that were signed by
@@ -143,22 +143,22 @@
     }
 
     /**
-     * Converts a {@link java.nio.ByteBuffer <tt>ByteBuffer</tt>}
-     * into an instance of class <tt>Class</tt>, with an optional CodeSource.
+     * Converts a {@link java.nio.ByteBuffer ByteBuffer}
+     * into an instance of class {@code Class}, with an optional CodeSource.
      * Before the class can be used it must be resolved.
      * <p>
      * If a non-null CodeSource is supplied a ProtectionDomain is
      * constructed and associated with the class being defined.
      * <p>
-     * @param      name the expected name of the class, or <code>null</code>
+     * @param      name the expected name of the class, or {@code null}
      *                  if not known, using '.' and not '/' as the separator
      *                  and without a trailing ".class" suffix.
      * @param      b    the bytes that make up the class data.  The bytes from positions
-     *                  <tt>b.position()</tt> through <tt>b.position() + b.limit() -1</tt>
+     *                  {@code b.position()} through {@code b.position() + b.limit() -1}
      *                  should have the format of a valid class file as defined by
      *                  <cite>The Java&trade; Virtual Machine Specification</cite>.
-     * @param      cs   the associated CodeSource, or <code>null</code> if none
-     * @return the <code>Class</code> object created from the data,
+     * @param      cs   the associated CodeSource, or {@code null} if none
+     * @return the {@code Class} object created from the data,
      *         and optional CodeSource.
      * @exception  ClassFormatError if the data did not contain a valid class
      * @exception  SecurityException if an attempt is made to add this class
diff --git a/ojluni/src/main/java/java/security/SecureRandomSpi.java b/ojluni/src/main/java/java/security/SecureRandomSpi.java
index 12652e9..ef6c243 100644
--- a/ojluni/src/main/java/java/security/SecureRandomSpi.java
+++ b/ojluni/src/main/java/java/security/SecureRandomSpi.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -27,7 +27,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>SecureRandom</code> class.
+ * for the {@code SecureRandom} class.
  * All the abstract methods in this class must be implemented by each
  * service provider who wishes to supply the implementation
  * of a cryptographically strong pseudo-random number generator.
@@ -53,10 +53,10 @@
     /**
      * Generates a user-specified number of random bytes.
      *
-     * <p> If a call to <code>engineSetSeed</code> had not occurred previously,
+     * <p> If a call to {@code engineSetSeed} had not occurred previously,
      * the first call to this method forces this SecureRandom implementation
      * to seed itself.  This self-seeding will not occur if
-     * <code>engineSetSeed</code> was previously called.
+     * {@code engineSetSeed} was previously called.
      *
      * @param bytes the array to be filled in with random bytes.
      */
diff --git a/ojluni/src/main/java/java/security/Security.java b/ojluni/src/main/java/java/security/Security.java
index 003fb81..99d5526 100644
--- a/ojluni/src/main/java/java/security/Security.java
+++ b/ojluni/src/main/java/java/security/Security.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.io.*;
-
 import sun.security.jca.GetInstance;
 import sun.security.jca.ProviderList;
 import sun.security.jca.Providers;
@@ -40,6 +39,10 @@
  * <p>This class centralizes all security properties and common security
  * methods. One of its primary uses is to manage providers.
  *
+ * <p>The default values of security properties are read from an
+ * implementation-specific location, which is typically the properties file
+ * {@code lib/security/java.security} in the Java installation directory.
+ *
  * @author Benjamin Renaud
  */
 
@@ -186,7 +189,7 @@
      * property in the master file of the "SUN" Cryptographic Service
      * Provider in order to determine how to parse algorithm-specific
      * parameters. Use the new provider-based and algorithm-independent
-     * <code>AlgorithmParameters</code> and <code>KeyFactory</code> engine
+     * {@code AlgorithmParameters} and {@code KeyFactory} engine
      * classes (introduced in the J2SE version 1.2 platform) instead.
      */
     @Deprecated
@@ -209,22 +212,18 @@
      *
      * <p>If the given provider is installed at the requested position,
      * the provider that used to be at that position, and all providers
-     * with a position greater than <code>position</code>, are shifted up
+     * with a position greater than {@code position}, are shifted up
      * one position (towards the end of the list of installed providers).
      *
      * <p>A provider cannot be added if it is already installed.
      *
-     * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code>
-     * method is called with the string
-     * <code>"insertProvider."+provider.getName()</code>
-     * to see if it's ok to add a new provider.
-     * If the default implementation of <code>checkSecurityAccess</code>
-     * is used (i.e., that method is not overriden), then this will result in
-     * a call to the security manager's <code>checkPermission</code> method
-     * with a
-     * <code>SecurityPermission("insertProvider."+provider.getName())</code>
-     * permission.
+     * <p>If there is a security manager, the
+     * {@link java.lang.SecurityManager#checkSecurityAccess} method is called
+     * with the {@code "insertProvider"} permission target name to see if
+     * it's ok to add a new provider. If this permission check is denied,
+     * {@code checkSecurityAccess} is called again with the
+     * {@code "insertProvider."+provider.getName()} permission target name. If
+     * both checks are denied, a {@code SecurityException} is thrown.
      *
      * @param provider the provider to be added.
      *
@@ -237,8 +236,8 @@
      *
      * @throws  NullPointerException if provider is null
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies access to add a new provider
      *
      * @see #getProvider
@@ -248,7 +247,10 @@
     public static synchronized int insertProviderAt(Provider provider,
             int position) {
         String providerName = provider.getName();
-        check("insertProvider." + providerName);
+        // ANDROID-REMOVED
+        // Checks using SecurityManager, which is not functional in Android.
+        // checkInsertProvider(providerName);
+        // ANDROID-REMOVED
         ProviderList list = Providers.getFullProviderList();
         ProviderList newList = ProviderList.insertAt(list, provider, position - 1);
         if (list == newList) {
@@ -262,17 +264,13 @@
     /**
      * Adds a provider to the next position available.
      *
-     * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code>
-     * method is called with the string
-     * <code>"insertProvider."+provider.getName()</code>
-     * to see if it's ok to add a new provider.
-     * If the default implementation of <code>checkSecurityAccess</code>
-     * is used (i.e., that method is not overriden), then this will result in
-     * a call to the security manager's <code>checkPermission</code> method
-     * with a
-     * <code>SecurityPermission("insertProvider."+provider.getName())</code>
-     * permission.
+     * <p>If there is a security manager, the
+     * {@link java.lang.SecurityManager#checkSecurityAccess} method is called
+     * with the {@code "insertProvider"} permission target name to see if
+     * it's ok to add a new provider. If this permission check is denied,
+     * {@code checkSecurityAccess} is called again with the
+     * {@code "insertProvider."+provider.getName()} permission target name. If
+     * both checks are denied, a {@code SecurityException} is thrown.
      *
      * @param provider the provider to be added.
      *
@@ -282,8 +280,8 @@
      *
      * @throws  NullPointerException if provider is null
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies access to add a new provider
      *
      * @see #getProvider
@@ -312,20 +310,20 @@
      * if name is null.
      *
      * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code>
-     * method is called with the string <code>"removeProvider."+name</code>
+     * {@code checkSecurityAccess}
+     * method is called with the string {@code "removeProvider."+name}
      * to see if it's ok to remove the provider.
-     * If the default implementation of <code>checkSecurityAccess</code>
+     * If the default implementation of {@code checkSecurityAccess}
      * is used (i.e., that method is not overriden), then this will result in
-     * a call to the security manager's <code>checkPermission</code> method
-     * with a <code>SecurityPermission("removeProvider."+name)</code>
+     * a call to the security manager's {@code checkPermission} method
+     * with a {@code SecurityPermission("removeProvider."+name)}
      * permission.
      *
      * @param name the name of the provider to remove.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies
      *          access to remove the provider
      *
@@ -370,8 +368,8 @@
      * Returns an array containing all installed providers that satisfy the
      * specified selection criterion, or null if no such providers have been
      * installed. The returned providers are ordered
-     * according to their <a href=
-     * "#insertProviderAt(java.security.Provider, int)">preference order</a>.
+     * according to their
+     * {@linkplain #insertProviderAt(java.security.Provider, int) preference order}.
      *
      * <p> A cryptographic service is always associated with a particular
      * algorithm or type. For example, a digital signature service is
@@ -382,8 +380,8 @@
      * <p>The selection criterion must be specified in one of the following two
      * formats:
      * <ul>
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type></i> <p> The
-     * cryptographic service name must not contain any dots.
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>}</i>
+     * <p> The cryptographic service name must not contain any dots.
      * <p> A
      * provider satisfies the specified selection criterion iff the provider
      * implements the
@@ -391,11 +389,12 @@
      * <p> For example, "CertificateFactory.X.509"
      * would be satisfied by any provider that supplied
      * a CertificateFactory implementation for X.509 certificates.
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type>
-     * &lt;attribute_name>:&lt attribute_value></i>
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>
+     * <attribute_name>:<attribute_value>}</i>
      * <p> The cryptographic service name must not contain any dots. There
-     * must be one or more space charaters between the
-     * <i>&lt;algorithm_or_type></i> and the <i>&lt;attribute_name></i>.
+     * must be one or more space characters between the
+     * <i>{@literal <algorithm_or_type>}</i> and the
+     * <i>{@literal <attribute_name>}</i>.
      *  <p> A provider satisfies this selection criterion iff the
      * provider implements the specified algorithm or type for the specified
      * cryptographic service and its implementation meets the
@@ -448,8 +447,9 @@
      * Returns an array containing all installed providers that satisfy the
      * specified* selection criteria, or null if no such providers have been
      * installed. The returned providers are ordered
-     * according to their <a href=
-     * "#insertProviderAt(java.security.Provider, int)">preference order</a>.
+     * according to their
+     * {@linkplain #insertProviderAt(java.security.Provider, int)
+     * preference order}.
      *
      * <p>The selection criteria are represented by a map.
      * Each map entry represents a selection criterion.
@@ -457,16 +457,18 @@
      * criteria. The key for any entry in such a map must be in one of the
      * following two formats:
      * <ul>
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type></i>
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>}</i>
      * <p> The cryptographic service name must not contain any dots.
      * <p> The value associated with the key must be an empty string.
      * <p> A provider
      * satisfies this selection criterion iff the provider implements the
      * specified algorithm or type for the specified cryptographic service.
-     * <li>  <i>&lt;crypto_service>.&lt;algorithm_or_type> &lt;attribute_name></i>
+     * <li>  <i>{@literal <crypto_service>}.
+     * {@literal <algorithm_or_type> <attribute_name>}</i>
      * <p> The cryptographic service name must not contain any dots. There
-     * must be one or more space charaters between the <i>&lt;algorithm_or_type></i>
-     * and the <i>&lt;attribute_name></i>.
+     * must be one or more space characters between the
+     * <i>{@literal <algorithm_or_type>}</i>
+     * and the <i>{@literal <attribute_name>}</i>.
      * <p> The value associated with the key must be a non-empty string.
      * A provider satisfies this selection criterion iff the
      * provider implements the specified algorithm or type for the specified
@@ -552,15 +554,16 @@
     }
 
     // Map containing cached Spi Class objects of the specified type
-    private static final Map<String, Class> spiMap = new ConcurrentHashMap<>();
+    private static final Map<String, Class<?>> spiMap =
+            new ConcurrentHashMap<>();
 
     /**
      * Return the Class object for the given engine type
      * (e.g. "MessageDigest"). Works for Spis in the java.security package
      * only.
      */
-    private static Class getSpiClass(String type) {
-        Class clazz = spiMap.get(type);
+    private static Class<?> getSpiClass(String type) {
+        Class<?> clazz = spiMap.get(type);
         if (clazz != null) {
             return clazz;
         }
@@ -578,7 +581,7 @@
      * an instance of an implementation of the requested algorithm
      * and type, and the second object in the array identifies the provider
      * of that implementation.
-     * The <code>provider</code> argument can be null, in which case all
+     * The {@code provider} argument can be null, in which case all
      * configured providers will be searched in order of preference.
      */
     static Object[] getImpl(String algorithm, String type, String provider)
@@ -609,7 +612,7 @@
      * an instance of an implementation of the requested algorithm
      * and type, and the second object in the array identifies the provider
      * of that implementation.
-     * The <code>provider</code> argument cannot be null.
+     * The {@code provider} argument cannot be null.
      */
     static Object[] getImpl(String algorithm, String type, Provider provider)
             throws NoSuchAlgorithmException {
@@ -628,8 +631,8 @@
      * Gets a security property value.
      *
      * <p>First, if there is a security manager, its
-     * <code>checkPermission</code>  method is called with a
-     * <code>java.security.SecurityPermission("getProperty."+key)</code>
+     * {@code checkPermission}  method is called with a
+     * {@code java.security.SecurityPermission("getProperty."+key)}
      * permission to see if it's ok to retrieve the specified
      * security property value..
      *
@@ -638,8 +641,8 @@
      * @return the value of the security property corresponding to key.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkPermission}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkPermission} method
      *          denies
      *          access to retrieve the specified security property value
      * @throws  NullPointerException is key is null
@@ -663,8 +666,8 @@
      * Sets a security property value.
      *
      * <p>First, if there is a security manager, its
-     * <code>checkPermission</code> method is called with a
-     * <code>java.security.SecurityPermission("setProperty."+key)</code>
+     * {@code checkPermission} method is called with a
+     * {@code java.security.SecurityPermission("setProperty."+key)}
      * permission to see if it's ok to set the specified
      * security property value.
      *
@@ -673,8 +676,8 @@
      * @param datum the value of the property to be set.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkPermission}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkPermission} method
      *          denies access to set the specified security property value
      * @throws  NullPointerException if key or datum is null
      *
@@ -708,7 +711,7 @@
                 public Void run() {
                     try {
                         /* Get the class via the bootstrap class loader. */
-                        Class cl = Class.forName(
+                        Class<?> cl = Class.forName(
                             "java.lang.SecurityManager", false, null);
                         Field f = null;
                         boolean accessible = false;
@@ -971,7 +974,7 @@
 
         if ((serviceName == null) || (serviceName.length() == 0) ||
             (serviceName.endsWith("."))) {
-            return Collections.EMPTY_SET;
+            return Collections.emptySet();
         }
 
         HashSet<String> result = new HashSet<>();
@@ -981,8 +984,10 @@
             // Check the keys for each provider.
             for (Enumeration<Object> e = providers[i].keys();
                                                 e.hasMoreElements(); ) {
-                String currentKey = ((String)e.nextElement()).toUpperCase();
-                if (currentKey.startsWith(serviceName.toUpperCase())) {
+                String currentKey =
+                        ((String)e.nextElement()).toUpperCase(Locale.ENGLISH);
+                if (currentKey.startsWith(
+                        serviceName.toUpperCase(Locale.ENGLISH))) {
                     // We should skip the currentKey if it contains a
                     // whitespace. The reason is: such an entry in the
                     // provider property contains attributes for the
@@ -990,7 +995,8 @@
                     // in entries which lead to the implementation
                     // classes.
                     if (currentKey.indexOf(" ") < 0) {
-                        result.add(currentKey.substring(serviceName.length() + 1));
+                        result.add(currentKey.substring(
+                                                serviceName.length() + 1));
                     }
                 }
             }
diff --git a/ojluni/src/main/java/java/security/SignatureException.java b/ojluni/src/main/java/java/security/SignatureException.java
index c47de31..2e1fa59 100644
--- a/ojluni/src/main/java/java/security/SignatureException.java
+++ b/ojluni/src/main/java/java/security/SignatureException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -56,13 +56,13 @@
     }
 
     /**
-     * Creates a <code>SignatureException</code> with the specified
+     * Creates a {@code SignatureException} with the specified
      * detail message and cause.
      *
      * @param message the detail message (which is saved for later retrieval
      *        by the {@link #getMessage()} method).
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
@@ -71,13 +71,13 @@
     }
 
     /**
-     * Creates a <code>SignatureException</code> with the specified cause
-     * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
+     * Creates a {@code SignatureException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
      * (which typically contains the class and detail message of
-     * <tt>cause</tt>).
+     * {@code cause}).
      *
      * @param cause the cause (which is saved for later retrieval by the
-     *        {@link #getCause()} method).  (A <tt>null</tt> value is permitted,
+     *        {@link #getCause()} method).  (A {@code null} value is permitted,
      *        and indicates that the cause is nonexistent or unknown.)
      * @since 1.5
      */
diff --git a/ojluni/src/main/java/java/security/SignatureSpi.java b/ojluni/src/main/java/java/security/SignatureSpi.java
index d18b361..8a10af9 100644
--- a/ojluni/src/main/java/java/security/SignatureSpi.java
+++ b/ojluni/src/main/java/java/security/SignatureSpi.java
@@ -36,7 +36,7 @@
 
 /**
  * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
- * for the <code>Signature</code> class, which is used to provide the
+ * for the {@code Signature} class, which is used to provide the
  * functionality of a digital signature algorithm. Digital signatures are used
  * for authentication and integrity assurance of digital data.
  *.
@@ -131,8 +131,8 @@
 
     /**
      * Updates the data to be signed or verified using the specified
-     * ByteBuffer. Processes the <code>data.remaining()</code> bytes
-     * starting at at <code>data.position()</code>.
+     * ByteBuffer. Processes the {@code data.remaining()} bytes
+     * starting at at {@code data.position()}.
      * Upon return, the buffer's position will be equal to its limit;
      * its limit will not have changed.
      *
@@ -184,14 +184,14 @@
 
     /**
      * Finishes this signature operation and stores the resulting signature
-     * bytes in the provided buffer <code>outbuf</code>, starting at
-     * <code>offset</code>.
+     * bytes in the provided buffer {@code outbuf}, starting at
+     * {@code offset}.
      * The format of the signature depends on the underlying
      * signature scheme.
      *
      * <p>The signature implementation is reset to its initial state
      * (the state it was in after a call to one of the
-     * <code>engineInitSign</code> methods)
+     * {@code engineInitSign} methods)
      * and can be reused to generate further signatures with the same private
      * key.
      *
@@ -201,10 +201,10 @@
      *
      * @param outbuf buffer for the signature result.
      *
-     * @param offset offset into <code>outbuf</code> where the signature is
+     * @param offset offset into {@code outbuf} where the signature is
      * stored.
      *
-     * @param len number of bytes within <code>outbuf</code> allotted for the
+     * @param len number of bytes within {@code outbuf} allotted for the
      * signature.
      * Both this default implementation and the SUN provider do not
      * return partial digests. If the value of this parameter is less
@@ -213,11 +213,11 @@
      * This parameter is ignored if its value is greater than or equal to
      * the actual signature length.
      *
-     * @return the number of bytes placed into <code>outbuf</code>
+     * @return the number of bytes placed into {@code outbuf}
      *
      * @exception SignatureException if the engine is not
      * initialized properly, if this signature algorithm is unable to
-     * process the input data provided, or if <code>len</code> is less
+     * process the input data provided, or if {@code len} is less
      * than the actual signature length.
      *
      * @since 1.2
@@ -294,7 +294,7 @@
      *
      * @param value the parameter value.
      *
-     * @exception InvalidParameterException if <code>param</code> is an
+     * @exception InvalidParameterException if {@code param} is an
      * invalid parameter for this signature algorithm engine,
      * the parameter is already set
      * and cannot be set again, a security exception occurs, and so on.
@@ -363,7 +363,7 @@
      * @return the object that represents the parameter value, or null if
      * there is none.
      *
-     * @exception InvalidParameterException if <code>param</code> is an
+     * @exception InvalidParameterException if {@code param} is an
      * invalid parameter for this engine, or another exception occurs while
      * trying to get this parameter.
      *
@@ -380,7 +380,7 @@
      * @return a clone if the implementation is cloneable.
      *
      * @exception CloneNotSupportedException if this is called
-     * on an implementation that does not support <code>Cloneable</code>.
+     * on an implementation that does not support {@code Cloneable}.
      */
     public Object clone() throws CloneNotSupportedException {
         if (this instanceof Cloneable) {
diff --git a/ojluni/src/main/java/java/security/SignedObject.java b/ojluni/src/main/java/java/security/SignedObject.java
index 1f901fa..9ac864e 100644
--- a/ojluni/src/main/java/java/security/SignedObject.java
+++ b/ojluni/src/main/java/java/security/SignedObject.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,44 +40,44 @@
  * the original object has no side effect on the copy.
  *
  * <p> The underlying signing algorithm is designated by the Signature
- * object passed to the constructor and the <code>verify</code> method.
+ * object passed to the constructor and the {@code verify} method.
  * A typical usage for signing is the following:
  *
- * <p> <code> <pre>
+ * <pre>{@code
  * Signature signingEngine = Signature.getInstance(algorithm,
  *                                                 provider);
  * SignedObject so = new SignedObject(myobject, signingKey,
  *                                    signingEngine);
- * </pre> </code>
+ * }</pre>
  *
  * <p> A typical usage for verification is the following (having
- * received SignedObject <code>so</code>):
+ * received SignedObject {@code so}):
  *
- * <p> <code> <pre>
+ * <pre>{@code
  * Signature verificationEngine =
  *     Signature.getInstance(algorithm, provider);
  * if (so.verify(publickey, verificationEngine))
  *     try {
  *         Object myobj = so.getObject();
  *     } catch (java.lang.ClassNotFoundException e) {};
- * </pre> </code>
+ * }</pre>
  *
  * <p> Several points are worth noting.  First, there is no need to
  * initialize the signing or verification engine, as it will be
- * re-initialized inside the constructor and the <code>verify</code>
+ * re-initialized inside the constructor and the {@code verify}
  * method. Secondly, for verification to succeed, the specified
  * public key must be the public key corresponding to the private key
  * used to generate the SignedObject.
  *
  * <p> More importantly, for flexibility reasons, the
- * constructor and <code>verify</code> method allow for
+ * constructor and {@code verify} method allow for
  * customized signature engines, which can implement signature
  * algorithms that are not installed formally as part of a crypto
  * provider.  However, it is crucial that the programmer writing the
- * verifier code be aware what <code>Signature</code> engine is being
- * used, as its own implementation of the <code>verify</code> method
+ * verifier code be aware what {@code Signature} engine is being
+ * used, as its own implementation of the {@code verify} method
  * is invoked to verify a signature.  In other words, a malicious
- * <code>Signature</code> may choose to always return true on
+ * {@code Signature} may choose to always return true on
  * verification in an attempt to bypass a security check.
  *
  * <p> The signature algorithm can be, among others, the NIST standard
@@ -92,7 +92,7 @@
  *
  * <p> The name of the Cryptography Package Provider is designated
  * also by the Signature parameter to the constructor and the
- * <code>verify</code> method.  If the provider is not
+ * {@code verify} method.  If the provider is not
  * specified, the default provider is used.  Each installation can
  * be configured to use a particular provider as default.
  *
@@ -214,8 +214,8 @@
      * @exception SignatureException if signature verification failed.
      * @exception InvalidKeyException if the verification key is invalid.
      *
-     * @return <tt>true</tt> if the signature
-     * is valid, <tt>false</tt> otherwise
+     * @return {@code true} if the signature
+     * is valid, {@code false} otherwise
      */
     public boolean verify(PublicKey verificationKey,
                           Signature verificationEngine)
diff --git a/ojluni/src/main/java/java/security/Signer.java b/ojluni/src/main/java/java/security/Signer.java
index 9224780..077538d 100644
--- a/ojluni/src/main/java/java/security/Signer.java
+++ b/ojluni/src/main/java/java/security/Signer.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,9 +40,9 @@
  * @author Benjamin Renaud
  *
  * @deprecated This class is no longer used. Its functionality has been
- * replaced by <code>java.security.KeyStore</code>, the
- * <code>java.security.cert</code> package, and
- * <code>java.security.Principal</code>.
+ * replaced by {@code java.security.KeyStore}, the
+ * {@code java.security.cert} package, and
+ * {@code java.security.Principal}.
  */
 @Deprecated
 public abstract class Signer extends Identity {
@@ -92,15 +92,15 @@
     /**
      * Returns this signer's private key.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"getSignerPrivateKey"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "getSignerPrivateKey"}
      * as its argument to see if it's ok to return the private key.
      *
      * @return this signer's private key, or null if the private key has
      * not yet been set.
      *
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * returning the private key.
      *
      * @see SecurityManager#checkSecurityAccess
@@ -113,8 +113,8 @@
    /**
      * Sets the key pair (public key and private key) for this signer.
      *
-     * <p>First, if there is a security manager, its <code>checkSecurityAccess</code>
-     * method is called with <code>"setSignerKeyPair"</code>
+     * <p>First, if there is a security manager, its {@code checkSecurityAccess}
+     * method is called with {@code "setSignerKeyPair"}
      * as its argument to see if it's ok to set the key pair.
      *
      * @param pair an initialized key pair.
@@ -124,7 +124,7 @@
      * @exception KeyException if the key pair cannot be set for any
      * other reason.
      * @exception  SecurityException  if a security manager exists and its
-     * <code>checkSecurityAccess</code> method doesn't allow
+     * {@code checkSecurityAccess} method doesn't allow
      * setting the key pair.
      *
      * @see SecurityManager#checkSecurityAccess
diff --git a/ojluni/src/main/java/java/security/UnresolvedPermissionCollection.java b/ojluni/src/main/java/java/security/UnresolvedPermissionCollection.java
index 69f6e60..7633648 100644
--- a/ojluni/src/main/java/java/security/UnresolvedPermissionCollection.java
+++ b/ojluni/src/main/java/java/security/UnresolvedPermissionCollection.java
@@ -197,8 +197,12 @@
         ObjectInputStream.GetField gfields = in.readFields();
 
         // Get permissions
+        @SuppressWarnings("unchecked")
+        // writeObject writes a Hashtable<String, Vector<UnresolvedPermission>>
+        // for the permissions key, so this cast is safe, unless the data is corrupt.
         Hashtable<String, Vector<UnresolvedPermission>> permissions =
-                (Hashtable<String, Vector<UnresolvedPermission>>)gfields.get("permissions", null);
+                (Hashtable<String, Vector<UnresolvedPermission>>)
+                gfields.get("permissions", null);
         perms = new HashMap<String, List<UnresolvedPermission>>(permissions.size()*2);
 
         // Convert each entry (Vector) into a List
diff --git a/ojluni/src/main/java/java/security/package-info.java b/ojluni/src/main/java/java/security/package-info.java
new file mode 100644
index 0000000..376aa9d
--- /dev/null
+++ b/ojluni/src/main/java/java/security/package-info.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * Provides the classes and interfaces for the security framework.
+ * This includes classes that implement an easily configurable,
+ * fine-grained access control security architecture.
+ * This package also supports
+ * the generation and storage of cryptographic public key pairs,
+ * as well as a number of exportable cryptographic operations
+ * including those for message digest and signature generation.  Finally,
+ * this package provides classes that support signed/guarded objects
+ * and secure random number generation.
+ *
+ * Many of the classes provided in this package (the cryptographic
+ * and secure random number generator classes in particular) are
+ * provider-based.  The class itself defines a programming interface
+ * to which applications may write.  The implementations themselves may
+ * then be written by independent third-party vendors and plugged
+ * in seamlessly as needed.  Therefore application developers may
+ * take advantage of any number of provider-based implementations
+ * without having to add or rewrite code.
+ *
+ * <h2>Package Specification</h2>
+ *
+ * <ul>
+ *   <li><a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/crypto/CryptoSpec.html">
+ *     <b>Java&trade;
+ *     Cryptography Architecture (JCA) Reference Guide</b></a></li>
+ *
+ *   <li>PKCS #8: Private-Key Information Syntax Standard, Version 1.2,
+ *     November 1993</li>
+ *
+ *   <li><a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/StandardNames.html">
+ *     <b>Java&trade;
+ *     Cryptography Architecture Standard Algorithm Name
+ *     Documentation</b></a></li>
+ * </ul>
+ *
+ * <h2>Related Documentation</h2>
+ *
+ * For further documentation, please see:
+ * <ul>
+ *   <li><a href=
+ *     "{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/spec/security-spec.doc.html">
+ *     <b>Java&trade;
+ *     SE Platform Security Architecture</b></a></li>
+ *
+ *   <li><a href=
+ *     "{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/crypto/HowToImplAProvider.html">
+ *     <b>How to Implement a Provider in the
+ *     Java&trade; Cryptography Architecture
+ *     </b></a></li>
+ *
+ *   <li><a href=
+ *     "{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/PolicyFiles.html"><b>
+ *     Default Policy Implementation and Policy File Syntax
+ *     </b></a></li>
+ *
+ *   <li><a href=
+ *     "{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/permissions.html"><b>
+ *     Permissions in the
+ *     Java&trade; SE Development Kit (JDK)
+ *     </b></a></li>
+ *
+ *   <li><a href=
+ *     "{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/guides/security/SecurityToolsSummary.html"><b>
+ *     Summary of Tools for
+ *     Java&trade; Platform Security
+ *     </b></a></li>
+ *
+ *   <li><b>keytool</b>
+ *     (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/tools/unix/keytool.html">
+ *       for Solaris/Linux</a>)
+ *     (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/tools/windows/keytool.html">
+ *       for Windows</a>)
+ *     </li>
+ *
+ *   <li><b>jarsigner</b>
+ *     (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/tools/unix/jarsigner.html">
+ *       for Solaris/Linux</a>)
+ *     (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/../technotes/tools/windows/jarsigner.html">
+ *       for Windows</a>)
+ *     </li>
+ *
+ * </ul>
+ *
+ * @since 1.1
+ */
+package java.security;
diff --git a/ojluni/src/main/java/java/security/package.html b/ojluni/src/main/java/java/security/package.html
deleted file mode 100755
index 52d427a..0000000
--- a/ojluni/src/main/java/java/security/package.html
+++ /dev/null
@@ -1,117 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
-<html>
-<head>
-<!--
-Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
-DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-
-This code is free software; you can redistribute it and/or modify it
-under the terms of the GNU General Public License version 2 only, as
-published by the Free Software Foundation.  Oracle designates this
-particular file as subject to the "Classpath" exception as provided
-by Oracle in the LICENSE file that accompanied this code.
-
-This code is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-version 2 for more details (a copy is included in the LICENSE file that
-accompanied this code).
-
-You should have received a copy of the GNU General Public License version
-2 along with this work; if not, write to the Free Software Foundation,
-Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-or visit www.oracle.com if you need additional information or have any
-questions.
--->
-
-</head>
-<body bgcolor="white">
-
-Provides the classes and interfaces for the security framework.
-This includes classes that implement an easily configurable,
-fine-grained access control security architecture.
-This package also supports
-the generation and storage of cryptographic public key pairs,
-as well as a number of exportable cryptographic operations
-including those for message digest and signature generation.  Finally,
-this package provides classes that support signed/guarded objects
-and secure random number generation.
-
-Many of the classes provided in this package (the cryptographic
-and secure random number generator classes in particular) are
-provider-based.  The class itself defines a programming interface
-to which applications may write.  The implementations themselves may
-then be written by independent third-party vendors and plugged
-in seamlessly as needed.  Therefore application developers may
-take advantage of any number of provider-based implementations
-without having to add or rewrite code.
-
-<h2>Package Specification</h2>
-
-<ul>
-  <li><a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/crypto/CryptoSpec.html">
-    <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
-    Cryptography Architecture (JCA) Reference Guide</b></a></li>
-
-  <li>PKCS #8: Private-Key Information Syntax Standard, Version 1.2,
-    November 1993</li>
-
-  <li><a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/StandardNames.html">
-    <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
-    Cryptography Architecture Standard Algorithm Name 
-    Documentation</b></a></li>
-</ul>
-
-<h2>Related Documentation</h2>
-
-For further documentation, please see:
-<ul>
-  <li><a href=
-    "{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/spec/security-spec.doc.html">
-    <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
-    SE Platform Security Architecture</b></a></li>
-
-  <li><a href=
-    "{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/crypto/HowToImplAProvider.html">
-    <b>How to Implement a Provider in the
-    Java<FONT SIZE=-2><SUP>TM</SUP></FONT> Cryptography Architecture
-    </b></a></li>
-
-  <li><a href=
-    "{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/PolicyFiles.html"><b>
-    Default Policy Implementation and Policy File Syntax
-    </b></a></li>
-
-  <li><a href=
-    "{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/permissions.html"><b>
-    Permissions in the
-    Java<FONT SIZE=-2><SUP>TM</SUP></FONT> SE Development Kit (JDK)
-    </b></a></li>
-
-  <li><a href=
-    "{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/SecurityToolsSummary.html"><b>
-    Summary of Tools for
-    Java<FONT SIZE=-2><SUP>TM</SUP></FONT> Platform Security
-    </b></a></li>
-
-  <li><b>keytool</b>
-    (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/tools/solaris/keytool.html">
-      for Solaris/Linux</a>)
-    (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/tools/windows/keytool.html">
-      for Windows</a>)
-    </li>
-
-  <li><b>jarsigner</b>
-    (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/tools/solaris/jarsigner.html">
-      for Solaris/Linux</a>)
-    (<a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/tools/windows/jarsigner.html">
-      for Windows</a>)
-    </li>
-
-</ul>
-
-@since 1.1
-</body>
-</html>
diff --git a/openjdk_java_files.mk b/openjdk_java_files.mk
index e42ba9e..231d4d6 100644
--- a/openjdk_java_files.mk
+++ b/openjdk_java_files.mk
@@ -493,6 +493,7 @@
     ojluni/src/main/java/java/nio/file/spi/FileSystemProvider.java \
     ojluni/src/main/java/java/nio/file/spi/FileTypeDetector.java \
     ojluni/src/main/java/java/nio/package-info.java \
+    ojluni/src/main/java/java/security/package-info.java \
     ojluni/src/main/java/java/security/AccessControlContext.java \
     ojluni/src/main/java/java/security/AccessControlException.java \
     ojluni/src/main/java/java/security/AccessController.java \