You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by da...@apache.org on 2026/10/09 19:51:10 UTC
(camel) branch main updated: CAMEL-25468: Document Bouncy Castle 1.86 migration for Camel 4.22.2 (#27562)
This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 0694f01d42bd CAMEL-25468: Document Bouncy Castle 1.86 migration for Camel 4.22.2 (#27562)
0694f01d42bd is described below
commit 0694f01d42bd04b178e9b8fac03b9ec9095d0fe9
Author: Roman Stepaniuk <57...@users.noreply.github.com>
AuthorDate: Fri Oct 9 21:50:59 2026 +0200
CAMEL-25468: Document Bouncy Castle 1.86 migration for Camel 4.22.2 (#27562)
Document the camel-pqc breaking changes for Camel 4.22.2 on main, preserving
the existing camel-management upgrade entry. Distinguish lifecycle manager and
component defaults for DILITHIUM, CMCE, MLDSA, MLKEM and KYBER, use the
canonical SLH-DSA-SHA2-128S spelling and update the catalog copy.
Co-authored-by: Codex <co...@openai.com>
---
.../apache/camel/catalog/docs/pqc-component.adoc | 14 ++++-----
.../camel-pqc/src/main/docs/pqc-component.adoc | 14 ++++-----
.../pqc/PQCParameterSpecResolverTest.java | 4 +++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 34 ++++++++++++++++++++++
4 files changed, 52 insertions(+), 14 deletions(-)
diff --git a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
index 1a39419e84c7..3c57e80e1da0 100644
--- a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
+++ b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
@@ -89,19 +89,19 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an alias of the canonical na
|===
| Algorithm | Parameter sets
-| `MLDSA` | `ML-DSA-44`, `ML-DSA-65` (default), `ML-DSA-87`
-| `MLKEM` | `ML-KEM-512` (default), `ML-KEM-768`, `ML-KEM-1024`
+| `MLDSA` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65` (component default), `ML-DSA-87`
+| `MLKEM` | `ML-KEM-512` (component default), `ML-KEM-768` (lifecycle manager default), `ML-KEM-1024`
| `SLHDSA` | `SLH-DSA-SHA2-128S`, `SLH-DSA-SHAKE-256F`, ... (see `SLHDSAParameterSpec`)
| `FALCON` | `FALCON-512`, `FALCON-1024`
-| `DILITHIUM` | `ML-DSA-44`, `ML-DSA-65`, `ML-DSA-87` (default)
+| `DILITHIUM` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65`, `ML-DSA-87` (component default)
| `SPHINCSPLUS` | The `SLHDSA` parameter sets, for example `SLH-DSA-SHA2-128S` (default)
-| `KYBER` | `ML-KEM-512`, `ML-KEM-768`, `ML-KEM-1024` (default); `kyber512`, `kyber768` and `kyber1024` are accepted as aliases
+| `KYBER` | `ML-KEM-512`, `ML-KEM-768` (lifecycle manager default), `ML-KEM-1024` (component default); `kyber512`, `kyber768` and `kyber1024` are accepted as aliases
| `NTRU` | `ntruhps2048509`, ... (see `NTRUParameterSpec`)
| `NTRULPRime` | `ntrulpr653`, ... (see `NTRULPRimeParameterSpec`)
| `SNTRUPrime` | `sntrup761`, ... (see `SNTRUPrimeParameterSpec`)
| `BIKE` | `bike128`, `bike192`, `bike256`
| `HQC` | `hqc128`, `hqc192`, `hqc256`
-| `CMCE` | `mceliece460896`, `mceliece8192128f` (default), ... (see `org.bouncycastle.jcajce.spec.CMCEParameterSpec`)
+| `CMCE` | `mceliece460896` (lifecycle manager default), `mceliece8192128f` (component default), ... (see `org.bouncycastle.jcajce.spec.CMCEParameterSpec`)
| `FRODO` | `frodokem976aes` (default), `frodokem1344shake`, ... (see `org.bouncycastle.jcajce.spec.FrodoKEMParameterSpec`)
| `SABER` | `lightsaberkem128r3`, ... (see `SABERParameterSpec`)
|===
@@ -334,7 +334,7 @@ All other signature algorithms follow the exact same route pattern shown above f
|`SLHDSA`
|SLH-DSA
|BC
-|SLH-DSA-SHA2-128s
+|SLH-DSA-SHA2-128S
|`PQCDefaultSLHDSAMaterial`
|LMS
@@ -383,7 +383,7 @@ All other signature algorithms follow the exact same route pattern shown above f
|`SPHINCSPLUS`
|SLH-DSA
|BC
-|SLH-DSA-SHA2-128s
+|SLH-DSA-SHA2-128S
|`PQCDefaultSPHINCSPLUSMaterial`
|===
diff --git a/components/camel-pqc/src/main/docs/pqc-component.adoc b/components/camel-pqc/src/main/docs/pqc-component.adoc
index 1a39419e84c7..3c57e80e1da0 100644
--- a/components/camel-pqc/src/main/docs/pqc-component.adoc
+++ b/components/camel-pqc/src/main/docs/pqc-component.adoc
@@ -89,19 +89,19 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an alias of the canonical na
|===
| Algorithm | Parameter sets
-| `MLDSA` | `ML-DSA-44`, `ML-DSA-65` (default), `ML-DSA-87`
-| `MLKEM` | `ML-KEM-512` (default), `ML-KEM-768`, `ML-KEM-1024`
+| `MLDSA` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65` (component default), `ML-DSA-87`
+| `MLKEM` | `ML-KEM-512` (component default), `ML-KEM-768` (lifecycle manager default), `ML-KEM-1024`
| `SLHDSA` | `SLH-DSA-SHA2-128S`, `SLH-DSA-SHAKE-256F`, ... (see `SLHDSAParameterSpec`)
| `FALCON` | `FALCON-512`, `FALCON-1024`
-| `DILITHIUM` | `ML-DSA-44`, `ML-DSA-65`, `ML-DSA-87` (default)
+| `DILITHIUM` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65`, `ML-DSA-87` (component default)
| `SPHINCSPLUS` | The `SLHDSA` parameter sets, for example `SLH-DSA-SHA2-128S` (default)
-| `KYBER` | `ML-KEM-512`, `ML-KEM-768`, `ML-KEM-1024` (default); `kyber512`, `kyber768` and `kyber1024` are accepted as aliases
+| `KYBER` | `ML-KEM-512`, `ML-KEM-768` (lifecycle manager default), `ML-KEM-1024` (component default); `kyber512`, `kyber768` and `kyber1024` are accepted as aliases
| `NTRU` | `ntruhps2048509`, ... (see `NTRUParameterSpec`)
| `NTRULPRime` | `ntrulpr653`, ... (see `NTRULPRimeParameterSpec`)
| `SNTRUPrime` | `sntrup761`, ... (see `SNTRUPrimeParameterSpec`)
| `BIKE` | `bike128`, `bike192`, `bike256`
| `HQC` | `hqc128`, `hqc192`, `hqc256`
-| `CMCE` | `mceliece460896`, `mceliece8192128f` (default), ... (see `org.bouncycastle.jcajce.spec.CMCEParameterSpec`)
+| `CMCE` | `mceliece460896` (lifecycle manager default), `mceliece8192128f` (component default), ... (see `org.bouncycastle.jcajce.spec.CMCEParameterSpec`)
| `FRODO` | `frodokem976aes` (default), `frodokem1344shake`, ... (see `org.bouncycastle.jcajce.spec.FrodoKEMParameterSpec`)
| `SABER` | `lightsaberkem128r3`, ... (see `SABERParameterSpec`)
|===
@@ -334,7 +334,7 @@ All other signature algorithms follow the exact same route pattern shown above f
|`SLHDSA`
|SLH-DSA
|BC
-|SLH-DSA-SHA2-128s
+|SLH-DSA-SHA2-128S
|`PQCDefaultSLHDSAMaterial`
|LMS
@@ -383,7 +383,7 @@ All other signature algorithms follow the exact same route pattern shown above f
|`SPHINCSPLUS`
|SLH-DSA
|BC
-|SLH-DSA-SHA2-128s
+|SLH-DSA-SHA2-128S
|`PQCDefaultSPHINCSPLUSMaterial`
|===
diff --git a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
index 48e5d092d5ab..86b4005e5e07 100644
--- a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
+++ b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
@@ -62,6 +62,7 @@ class PQCParameterSpecResolverTest {
// the underscore form matching the BouncyCastle constant names is accepted as an alias
assertNotNull(PQCParameterSpecResolver.resolve("MLDSA", "ml_dsa_87"));
assertNotNull(PQCParameterSpecResolver.resolve("MLKEM", "ml_kem_1024"));
+ assertNotNull(PQCParameterSpecResolver.resolve("SPHINCSPLUS", "sha2_128s"));
}
@Test
@@ -140,6 +141,9 @@ class PQCParameterSpecResolverTest {
IllegalArgumentException frodo = assertThrows(IllegalArgumentException.class,
() -> PQCParameterSpecResolver.resolve("FRODO", "frodokem640aes"));
assertTrue(frodo.getMessage().contains("Unknown parameterSpec"));
+ IllegalArgumentException dilithium = assertThrows(IllegalArgumentException.class,
+ () -> PQCParameterSpecResolver.resolve("DILITHIUM", "dilithium2"));
+ assertTrue(dilithium.getMessage().contains("Unknown parameterSpec"));
}
@Test
diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index c742eee2a6c5..5b8d13eebf62 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -20,6 +20,40 @@ counted each exchange once per member route instead of once per entry into the g
unintended side effect of CAMEL-24590. The counters now count each exchange once per entry into the
group again, as in 4.22.0: calls nested inside another route of the same group are not counted again.
+=== camel-pqc - Bouncy Castle 1.86 (Breaking change)
+
+Camel 4.22.2 uses Bouncy Castle 1.86, which removes the legacy implementations of several post-quantum
+algorithms from the `BCPQC` provider.
+
+*Picnic removed.* Bouncy Castle 1.86 no longer ships Picnic, so the `PICNIC` value of the
+`signatureAlgorithm` option, the `PQCSignatureAlgorithms.PICNIC` constant and `PQCDefaultPicnicMaterial`
+have been removed. Routes signing with Picnic must move to another signature algorithm, such as `MLDSA`
+or `SLHDSA`.
+
+*Classic McEliece and FrodoKEM use the `BC` provider.* `CMCE` and `FRODO` are now served by the Classic
+McEliece and FrodoKEM implementations of the `BC` provider (JCA names `CMCE` and `FrodoKEM`) instead of
+`BCPQC`. That implementation has no `mceliece348864` or `frodokem640` parameter sets: the
+`parameterSpec` option rejects them, and the default parameter sets of the key lifecycle managers changed
+from `mceliece348864` to `mceliece460896` and from `frodokem640aes` to `frodokem976aes`.
+
+*Stored keys must be generated again.* The `BC` provider rejects the algorithm identifier of Classic
+McEliece and FrodoKEM keys generated by the removed `BCPQC` implementations, and Picnic keys can no
+longer be read at all. Keys of these algorithms held by a key lifecycle manager, a key store or the
+registry have to be regenerated, and the peers they are shared with updated.
+
+*`parameterSpec` for `DILITHIUM`, `SPHINCSPLUS` and `KYBER`.* These algorithms generate ML-DSA, SLH-DSA
+and ML-KEM keys, so `parameterSpec` now takes the standardized parameter-set names, for example
+`ML-DSA-65`, `SLH-DSA-SHA2-128S` or `ML-KEM-768`. The `dilithium2`, `dilithium3` and `dilithium5` names
+are no longer accepted, while `kyber512`, `kyber768`, `kyber1024` and SPHINCS+ names such as
+`sha2-128s` still are. With Bouncy Castle 1.85 a `DILITHIUM` or `SPHINCSPLUS` endpoint configured with a
+`parameterSpec` already failed to generate its key.
+
+Code that creates key material itself has to follow the same move: the `CMCEParameterSpec`,
+`FrodoParameterSpec`, `KyberParameterSpec`, `DilithiumParameterSpec`, `SPHINCSPlusParameterSpec` and
+`PicnicParameterSpec` classes of `org.bouncycastle.pqc.jcajce.spec` no longer exist. Use
+`CMCEParameterSpec`, `FrodoKEMParameterSpec`, `MLKEMParameterSpec`, `MLDSAParameterSpec` and
+`SLHDSAParameterSpec` of `org.bouncycastle.jcajce.spec` with the `BC` provider instead.
+
=== camel-netty-http - the roles of a security constraint are matched by role name
The roles of a `SecurityConstraintMapping` inclusion are a comma-separated list of role names, and an authenticated