BCJSSE: Don't enable ML-DSA signature schemes by default

Author: peterdettman

tls/src/main/java/org/bouncycastle/jsse/provider/SignatureSchemeInfo.java

@@ -596,11 +596,12 @@ private static int[] createCandidatesDefault()
         {
             int signatureScheme = values[i].signatureScheme;
 
-            /*
-             * SLH-DSA signing is quite slow; users will most likely be interested in it for the certificate
-             * chain, so we'll leave it to them to configure signature_algorithms_cert.
-             */
-            if (!SignatureScheme.isSLHDSA(signatureScheme))
+            if (SignatureScheme.isMLDSA(signatureScheme) ||
+                SignatureScheme.isSLHDSA(signatureScheme))
+            {
+                // For the time being, do not enable stand-alone PQ schemes by default
+            }
+            else
             {
                 result[pos++] = signatureScheme;
             }

tls/src/test/java/org/bouncycastle/jsse/provider/test/MLDSACredentialsTest.java

@@ -22,9 +22,23 @@
 public class MLDSACredentialsTest
     extends TestCase
 {
+    private static final String PROPERTY_CLIENT_SIGNATURE_SCHEMES = "jdk.tls.client.SignatureSchemes";
+    private static final String PROPERTY_SERVER_SIGNATURE_SCHEMES = "jdk.tls.server.SignatureSchemes";
+
     protected void setUp()
     {
         ProviderUtils.setupLowPriority(false);
+
+        String signatureSchemes = "mldsa44, mldsa65, mldsa87";
+
+        System.setProperty(PROPERTY_CLIENT_SIGNATURE_SCHEMES, signatureSchemes);
+        System.setProperty(PROPERTY_SERVER_SIGNATURE_SCHEMES, signatureSchemes);
+    }
+
+    protected void tearDown()
+    {
+        System.clearProperty(PROPERTY_CLIENT_SIGNATURE_SCHEMES);
+        System.clearProperty(PROPERTY_SERVER_SIGNATURE_SCHEMES);
     }
 
     private static final String HOST = "localhost";