[jira] [Assigned] (CAMEL-25794) camel-pqc - HSS, XMSSMT and SNTRUPrime get no default key material and fail at the first exchange

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25794?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino reassigned CAMEL-25794:
----------------------------------------

    Assignee: Andrea Cosentino

> camel-pqc - HSS, XMSSMT and SNTRUPrime get no default key material and fail at the first exchange
> -------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25794
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25794
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-pqc
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>
> {{PQCComponent}} autowires a default {{KeyPair}}/{{Signature}}/{{KeyGenerator}} for most algorithms, but three advertised constants are missing from the switches and fall through {{default: break;}}.
> h3. Signature switch — {{PQCComponent.java:100-139}}
> Covers MLDSA, SLHDSA, LMS, XMSS, FALCON, SNOVA, MAYO, DILITHIUM, SPHINCSPLUS. Missing: *HSS* and *XMSSMT*, although both are declared in {{PQCSignatureAlgorithms}}:
> {code:java}
>     HSS("LMS", "BC"),
>     XMSSMT("XMSSMT", "BCPQC"),
> {code}
> h3. KEM switch — {{PQCComponent.java:146-185}}
> Missing: *SNTRUPrime*, although {{PQCKeyEncapsulationAlgorithms}} declares it.
> h3. Consequence
> {{PQCDefaultHSSMaterial}}, {{PQCDefaultXMSSMTMaterial}} and {{PQCDefaultSNTRUPrimeMaterial}} all exist but have *zero references* anywhere in {{src/main/java}} or {{src/test/java}} — they are dead code.
> A route such as {{pqc:x?operation=sign&signatureAlgorithm=XMSSMT}} with no registry bean passes {{doStart()}} (the {{Signature}} is built) and then fails per-exchange with a {{NullPointerException}} at {{PQCProducer.java:530}}:
> {code:java}
>             signerForExchange.initSign(keyPair.getPrivate());
> {code}
> h3. The documentation promises the opposite
> {{src/main/docs/pqc-component.adoc:359}} and {{:366}} list {{PQCDefaultXMSSMTMaterial}} and {{PQCDefaultHSSMaterial}} in the "Other Signature Algorithms" table, and {{:421}} lists {{SNTRUPrime}} under supported KEMs with the usual "In case the KeyPair and the KeyGenerator Objects are not in the registry, it will provide two instances ... with default implementation."
> h3. Also in this file: a wrong JCA name in the docs
> {{pqc-component.adoc:363}} gives the JCA algorithm name for HSS as {{HSS}}. Bouncy Castle 1.86 registers only {{KeyPairGenerator.LMS}} / {{Signature.LMS}} / {{KeyFactory.LMS}} — there is no {{HSS}} service. The enum is correct ({{HSS("LMS", "BC")}}); the table is not.
> h3. Suggested fix
> Add the three missing {{case}} arms, and make the switch fall-through fail fast at endpoint creation rather than deferring to a per-exchange NPE.
> h3. Test gap
> Every other algorithm has a {{*NoAutowiredTest}} companion that exercises the URI-only path. There is none for HSS, XMSSMT or SNTRUPrime — {{PQCSignatureHSSTest}} and {{PQCSignatureXMSSMTTest}} bind their own registry beans, which is why CI does not see this.
> ----
> _Reported by Claude Code (AI agent) on behalf of [~oscerd]. Every code reference was verified against commit {{7aae27315946}} on {{main}}._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)