You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/10/19 09:32:22 UTC
[PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
oscerd opened a new pull request, #28093:
URL: https://github.com/apache/camel/pull/28093
Fixes [CAMEL-25798](https://issues.apache.org/jira/browse/CAMEL-25798).
## Problem
The three KEM operations disagreed about which name to stamp on the resulting secret key.
`generateEncapsulation` passed the raw configuration value:
```java
new KEMGenerateSpec(
keyPair.getPublic(),
getEndpoint().getConfiguration().getSymmetricKeyAlgorithm(),
```
while `extractEncapsulation` and `extractSecretKeyFromEncapsulation` both map it through the enum â the latter with a
comment spelling out the rule that `generateEncapsulation` broke:
```java
// Use the mapped JCE algorithm name (as extractEncapsulation does), not the raw enum name: for algorithms
// whose enum name differs from the JCE name (for example GOST3412_2015 -> GOST3412-2015) the raw name is not a
// resolvable cipher algorithm, so the restored key would carry an unusable algorithm label
```
Two of the eighteen constants differ: `GOST3412_2015("GOST3412-2015")` and `DESEDE("DESede")`. For those, the generate
side produced a key labelled `DESEDE` / `GOST3412_2015` while the extract side produced `DESede` / `GOST3412-2015`.
The generate-side label is not a resolvable cipher algorithm, so the key could not be passed to
`Cipher.getInstance(key.getAlgorithm())` or handed to `CryptoDataFormat`, and the two ends of one exchange disagreed on
the key's identity.
The existing tests encoded both answers: `PQCMLKEMGenerateEncapsulationCryptoRoundTripDESedeTest` asserted `"DESEDE"`
while `PQCExtractSecretKeyAlgorithmNameTest` asserted `"DESede"` for the same configured algorithm.
## Fix
`generateEncapsulation` now uses `PQCSymmetricAlgorithms.valueOf(...).getAlgorithm()`, matching both siblings.
It also gains the `symmetricKeyAlgorithm` guard the others already have. It was the only unguarded one of the five KEM
paths â `validateSymmetricKeyLength` returns early when the algorithm is empty, so a null reached BouncyCastle and
surfaced as an opaque `Missing argument`.
## Tests
New `PQCGenerateEncapsulationAlgorithmNameTest`:
- `generateAndExtractStampTheSameJceName` â asserts the generated label is the JCE name, that generate and extract
agree, and that the stamped name actually resolves via `Cipher.getInstance`, which is the point of the change;
- `aMissingSymmetricAlgorithmIsRejected`.
Both fail against `main` (`expected: <DESede> but was: <DESEDE>`, and `Missing argument` instead of the clear message).
`PQCMLKEMGenerateEncapsulationCryptoRoundTripDESedeTest` is updated to assert
`PQCSymmetricAlgorithms.DESEDE.getAlgorithm()`, matching how the AES tests already assert.
Full `camel-pqc` build green: 241 tests, 0 failures, no regenerated-file drift.
## Upgrade guide
Added a 4.24 entry â the label change is user-visible for `DESEDE` and `GOST3412_2015`, and code asserting on the old
value needs updating.
---
_Reported, analysed and fixed by Claude Code (AI agent) on behalf of @oscerd._
đ¤ Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28093:
URL: https://github.com/apache/camel/pull/28093#issuecomment-6264380954
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28093:
URL: https://github.com/apache/camel/pull/28093#issuecomment-6267514880
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-pqc`
- `docs`
---
<details><summary>:microscope: Scalpel shadow comparison â Scalpel: 8 of 706 tested, 26 compile-only â current: 8 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **8 affected modules** (current approach: 8).
**Skip-tests mode would test 8 modules** (2 direct + 7 downstream), **skip tests for 26** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (8)</summary>
- `camel-jbang-mcp` â downstream of org.apache.camel:camel-catalog
- `camel-jbang-plugin-mcp` â downstream of org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-tui` â downstream of org.apache.camel:camel-catalog
- `camel-jbang-plugin-validate` â downstream of org.apache.camel:camel-yaml-dsl-validator
- `camel-launcher-container` â downstream of org.apache.camel:camel-launcher
- `camel-pqc` â components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java, components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCGenerateEncapsulationAlgorithmNameTest.java, components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCMLKEMGenerateEncapsulationCryptoRoundTripDESedeTest.java
- `camel-yaml-dsl-validator` â downstream of org.apache.camel:camel-catalog
- `camel-yaml-dsl-validator-maven-plugin` â downstream of org.apache.camel:camel-yaml-dsl-validator
</details>
<details><summary>Modules with tests skipped (26)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `dummy-component`
</details>
> :information_source: Shadow mode â Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (35 modules, 5m 42s total)</summary>
**Total reactor time:** 5m 42s
| Module | Duration | Status |
| --- | --- | --- |
| Camel :: Launcher | 51.4s | SUCCESS |
| Camel :: JBang :: MCP | 45.0s | SUCCESS |
| Camel :: JBang :: Plugin :: Validate | 28.2s | SUCCESS |
| Camel :: YAML DSL | 25.9s | SUCCESS |
| Camel :: Catalog :: Camel Catalog | 24.3s | SUCCESS |
| Camel :: YAML DSL :: Validator | 23.9s | SUCCESS |
| Camel :: Component DSL | 22.3s | SUCCESS |
| Camel :: JBang :: Plugin :: Testing | 18.2s | SUCCESS |
| Camel :: Kamelet Main | 16.5s | SUCCESS |
| Camel :: Docs | 15.8s | SUCCESS |
| Camel :: JBang :: Plugin :: Kubernetes | 15.4s | SUCCESS |
| Camel :: Catalog :: Camel Report Maven Plugin | 11.5s | SUCCESS |
| Camel :: YAML DSL :: Deserializers | 8.1s | SUCCESS |
| Camel :: Catalog :: Camel Route Parser | 7.8s | SUCCESS |
| Camel :: All Components Sync point | 5.3s | SUCCESS |
| Camel :: YAML DSL :: Validator Maven Plugin | 4.1s | SUCCESS |
| Camel :: YAML DSL :: Maven Plugins | 3.2s | SUCCESS |
| Camel :: Catalog :: Suggest (deprecated) | 2.1s | SUCCESS |
| Camel :: Catalog :: Maven | 2.1s | SUCCESS |
| Camel :: JBang :: Plugin :: Edit | 1.2s | SUCCESS |
| Camel :: Assembly | 1.2s | SUCCESS |
| Camel :: JBang :: Main | 1.2s | SUCCESS |
| Camel :: JBang :: Plugin :: Generate | 1.2s | SUCCESS |
| Camel :: Coverage | 1.1s | SUCCESS |
| Camel :: Catalog :: Dummy Component | 1.0s | SUCCESS |
| Camel :: JBang :: Plugin :: MCP | 0.9s | SUCCESS |
| Camel :: Catalog :: Console | 0.9s | SUCCESS |
| Camel :: JBang :: Integration tests | 0.8s | SUCCESS |
| Camel :: Endpoint DSL :: Support | 0.8s | SUCCESS |
| Camel :: Launcher :: Container | 0.7s | SUCCESS |
| Camel :: Endpoint DSL | n/a | |
| Camel :: Integration Tests | n/a | |
| Camel :: JBang :: Core | n/a | |
| Camel :: JBang :: Plugin :: TUI | n/a | |
| Camel :: PQC | n/a | |
**Top 20 slowest modules:**
- `Camel :: Launcher` (51.4s)
- `Camel :: JBang :: MCP` (45.0s)
- `Camel :: JBang :: Plugin :: Validate` (28.2s)
- `Camel :: YAML DSL` (25.9s)
- `Camel :: Catalog :: Camel Catalog` (24.3s)
- `Camel :: YAML DSL :: Validator` (23.9s)
- `Camel :: Component DSL` (22.3s)
- `Camel :: JBang :: Plugin :: Testing` (18.2s)
- `Camel :: Kamelet Main` (16.5s)
- `Camel :: Docs` (15.8s)
- `Camel :: JBang :: Plugin :: Kubernetes` (15.4s)
- `Camel :: Catalog :: Camel Report Maven Plugin` (11.5s)
- `Camel :: YAML DSL :: Deserializers` (8.1s)
- `Camel :: Catalog :: Camel Route Parser` (7.8s)
- `Camel :: All Components Sync point` (5.3s)
- `Camel :: YAML DSL :: Validator Maven Plugin` (4.1s)
- `Camel :: YAML DSL :: Maven Plugins` (3.2s)
- `Camel :: Catalog :: Suggest (deprecated)` (2.1s)
- `Camel :: Catalog :: Maven` (2.1s)
- `Camel :: JBang :: Plugin :: Edit` (1.2s)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/39230827171)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #28093:
URL: https://github.com/apache/camel/pull/28093#issuecomment-6272737918
<!-- camel-backport-bot -->
### đ Backport Bot
This bugfix targets `main` and may need porting to:
- `camel-4.22.x`
Add a `port/<branch>` label to automatically create a backport PR for that branch.
Backport PRs will be created automatically on merge (once a port label is added). Comment `/port` to create them immediately.
âšī¸ If you push additional commits after `/port`, use `/port` again to update the port PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #28093:
URL: https://github.com/apache/camel/pull/28093#issuecomment-6290179488
Rebased onto `main`. The only conflict was the 4.24 upgrade guide, where several camel-pqc PRs had added their note at the same spot; this one now sits before the `camel-jbang - camel ask asks before a call that changes something, reaches out or runs code` section, at a different place from the other open camel-pqc PRs, so they stop conflicting with each other. No code change.
Verification: camel-pqc on JDK 21 (`mvn clean install`) and JDK 25 (`mvn test`: 276 tests, 0 failures), no regenerated-file drift.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #28093:
URL: https://github.com/apache/camel/pull/28093
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25798: camel-pqc - generateSecretKeyEncapsulation stamps the JCE algorithm name on the secret key [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #28093:
URL: https://github.com/apache/camel/pull/28093#issuecomment-6268612452
Thanks @davsclaus. The `assertInstanceOf` nit is in c7f400b.
On the hybrid paths: good catch, and I have filed it as **CAMEL-25824** rather than widening this PR, because it is not the same one-line change. As you note, `HybridKEM` uses that string twice â as the algorithm of the returned `SecretKeySpec`, which should be mapped, and as the HKDF `info` of `combineSecrets`, which must not be, or every previously produced encapsulation stops decrypting. The issue records both the fix and that trap.
_Claude Code on behalf of @oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org