Skip to content

Implement opt-out for PQ TLS #6648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
WillChilds-Klein wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Implement opt-out for PQ TLS #6648

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
123d3a9
Implement opt-out for PQ TLS
WillChilds-Klein Dec 29, 2025
991909d
Update release changelog
WillChilds-Klein Dec 29, 2025
8acd66a
Merge branch 'master' into pq-opt-out
WillChilds-Klein Dec 29, 2025
ffa362d
Only use opt-out policy if supported
WillChilds-Klein Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changes/next-release/bugfix-AWSSDKforJavav2-4b5fea2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"type": "bugfix",
"category": "AWS SDK for Java v2",
"contributor": "WillChilds-Klein",
"description": "Java CRT 0.39.3 enables and prefers PQ by default, so `TLS_CIPHER_SYSTEM_DEFAULT` now uses PQ cipher suites. The `postQuantumTlsEnabled` builder option in aws-sdk-java-v2 now becomes an opt-out mechanism; setting it to false explicitly disables PQ by using policy `TLS_CIPHER_PREF_TLSv1_0_2023`."
}
20 changes: 5 additions & 15 deletions ...ient/src/main/java/software/amazon/awssdk/http/crt/internal/AwsCrtConfigurationUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,11 @@
import software.amazon.awssdk.annotations.SdkInternalApi;
import software.amazon.awssdk.crt.io.SocketOptions;
import software.amazon.awssdk.crt.io.TlsCipherPreference;
import software.amazon.awssdk.http.crt.AwsCrtAsyncHttpClient;
import software.amazon.awssdk.http.crt.TcpKeepAliveConfiguration;
import software.amazon.awssdk.utils.Logger;
import software.amazon.awssdk.utils.NumericUtils;

@SdkInternalApi
public final class AwsCrtConfigurationUtils {
private static final Logger log = Logger.loggerFor(AwsCrtAsyncHttpClient.class);
Copy link
Author

@WillChilds-Klein WillChilds-Klein Dec 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was unused.


private AwsCrtConfigurationUtils() {
}
Expand Down Expand Up @@ -55,19 +52,12 @@ public static SocketOptions buildSocketOptions(TcpKeepAliveConfiguration tcpKeep
}

public static TlsCipherPreference resolveCipherPreference(Boolean postQuantumTlsEnabled) {
TlsCipherPreference defaultTls = TlsCipherPreference.TLS_CIPHER_SYSTEM_DEFAULT;
if (postQuantumTlsEnabled == null || !postQuantumTlsEnabled) {
return defaultTls;
// As of of v0.39.3, aws-crt-java prefers PQ by default, so only return the pre-PQ-default policy
// below if the caller explicitly disables PQ by passing in false.
if (Boolean.FALSE.equals(postQuantumTlsEnabled)) {
return TlsCipherPreference.TLS_CIPHER_PREF_TLSv1_0_2023;
}

TlsCipherPreference pqTls = TlsCipherPreference.TLS_CIPHER_PQ_DEFAULT;
if (!pqTls.isSupported()) {
log.warn(() -> "Hybrid post-quantum cipher suites are not supported on this platform. The SDK will use the system "
+ "default cipher suites instead");
return defaultTls;
}

return pqTls;
return TlsCipherPreference.TLS_CIPHER_SYSTEM_DEFAULT;
}

}
21 changes: 5 additions & 16 deletions .../src/test/java/software/amazon/awssdk/http/crt/internal/AwsCrtConfigurationUtilsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,41 +16,30 @@
package software.amazon.awssdk.http.crt.internal;

import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
import static software.amazon.awssdk.crt.io.TlsCipherPreference.TLS_CIPHER_PQ_DEFAULT;
import static software.amazon.awssdk.crt.io.TlsCipherPreference.TLS_CIPHER_PREF_TLSv1_0_2023;
import static software.amazon.awssdk.crt.io.TlsCipherPreference.TLS_CIPHER_SYSTEM_DEFAULT;

import java.time.Duration;
import java.util.stream.Stream;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Assumptions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import software.amazon.awssdk.crt.CrtResource;
import software.amazon.awssdk.crt.io.SocketOptions;
import software.amazon.awssdk.crt.io.TlsCipherPreference;
import software.amazon.awssdk.http.crt.TcpKeepAliveConfiguration;

class AwsCrtConfigurationUtilsTest {
@ParameterizedTest
@MethodSource("cipherPreferences")
void resolveCipherPreference_pqNotSupported_shouldFallbackToSystemDefault(Boolean preferPqTls,
TlsCipherPreference tlsCipherPreference) {
Assumptions.assumeFalse(TLS_CIPHER_PQ_DEFAULT.isSupported());
assertThat(AwsCrtConfigurationUtils.resolveCipherPreference(preferPqTls)).isEqualTo(tlsCipherPreference);
}

@Test
void resolveCipherPreference_pqSupported_shouldHonor() {
Assumptions.assumeTrue(TLS_CIPHER_PQ_DEFAULT.isSupported());
assertThat(AwsCrtConfigurationUtils.resolveCipherPreference(true)).isEqualTo(TLS_CIPHER_PQ_DEFAULT);
void resolveCipherPreference_shouldResolveCorrectly(Boolean postQuantumTlsEnabled,
TlsCipherPreference expectedPreference) {
assertThat(AwsCrtConfigurationUtils.resolveCipherPreference(postQuantumTlsEnabled)).isEqualTo(expectedPreference);
}

private static Stream<Arguments> cipherPreferences() {
return Stream.of(
Arguments.of(null, TLS_CIPHER_SYSTEM_DEFAULT),
Arguments.of(false, TLS_CIPHER_SYSTEM_DEFAULT),
Arguments.of(false, TLS_CIPHER_PREF_TLSv1_0_2023),
Arguments.of(true, TLS_CIPHER_SYSTEM_DEFAULT)
);
}
Expand Down
Loading