Skip to content

Commit 91ed2b0

Browse files
author
royb
committed
Merge branch 'main' into java-25-kdf
# Conflicts: # tls/build.gradle
2 parents b63220b + d9da0ba commit 91ed2b0

File tree

10 files changed

+130
-37
lines changed

10 files changed

+130
-37
lines changed

‎bc-build.properties‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
# intended to hold user-specific settings that are *not* committed to
44
# the repository.
55

6-
release.suffix: 1.82
7-
release.name: 1.82
8-
release.version: 1.82
6+
release.suffix: 1.83
7+
release.name: 1.83
8+
release.version: 1.83
99
release.debug: false
1010

1111
mail.jar.home: ./libs/javax.mail-1.4.7.jar

‎core/src/main/java/org/bouncycastle/pqc/crypto/util/PrivateKeyFactory.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,13 @@ else if (mlkemKey instanceof ASN1Sequence)
246246

247247
// TODO This should only allow seed but is length-flexible
248248
MLKEMPrivateKeyParameters mlkemPriv = new MLKEMPrivateKeyParameters(mlkemParams, seed, pubParams);
249+
250+
/*
251+
* RFC 9881 8.2. When receiving a private key that contains both the seed and the expandedKey, the
252+
* recipient SHOULD perform a seed consistency check to ensure that the sender properly generated
253+
* the private key. [..] If the check is done and the seed and the expandedKey are not consistent,
254+
* the recipient MUST reject the private key as malformed.
255+
*/
249256
if (!Arrays.constantTimeAreEqual(mlkemPriv.getEncoded(), encoding))
250257
{
251258
throw new IllegalArgumentException("inconsistent " + mlkemParams.getName() + " private key");

‎pkix/src/test/java/org/bouncycastle/cert/test/BcCertTest.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import org.bouncycastle.asn1.ASN1Object;
2525
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
2626
import org.bouncycastle.asn1.DERSequence;
27+
import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
2728
import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
2829
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
2930
import org.bouncycastle.asn1.x500.X500Name;
@@ -848,8 +849,8 @@ public void checkCreation3()
848849
try
849850
{
850851
ContentSigner sigGen = new BcECContentSignerBuilder(
851-
new AlgorithmIdentifier(X9ObjectIdentifiers.ecdsa_with_SHA1),
852-
new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1)).build(privKey);
852+
new AlgorithmIdentifier(X9ObjectIdentifiers.ecdsa_with_SHA256),
853+
new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256)).build(privKey);
853854
BcX509v3CertificateBuilder certGen = new BcX509v3CertificateBuilder(builder.build(), BigInteger.valueOf(1), new Date(System.currentTimeMillis() - 50000), new Date(System.currentTimeMillis() + 50000), builder.build(), pubKey);
854855

855856
X509CertificateHolder cert = certGen.build(sigGen);

‎pkix/src/test/java/org/bouncycastle/cert/test/CertTest.java‎

Lines changed: 70 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@
116116
import org.bouncycastle.jce.spec.ECPublicKeySpec;
117117
import org.bouncycastle.jce.spec.GOST3410ParameterSpec;
118118
import org.bouncycastle.math.ec.ECCurve;
119+
import org.bouncycastle.operator.BufferingContentSigner;
119120
import org.bouncycastle.operator.ContentSigner;
120121
import org.bouncycastle.operator.ContentVerifierProvider;
121122
import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
@@ -2905,8 +2906,14 @@ public void checkCRLCompositeCreation()
29052906
//
29062907
// create the certificate - version 3
29072908
//
2908-
CompositePublicKey compPub = new CompositePublicKey(IANAObjectIdentifiers.id_MLDSA65_ECDSA_P256_SHA512, mlDsaKp.getPublic(), ecPub);
2909-
CompositePrivateKey compPrivKey = new CompositePrivateKey(IANAObjectIdentifiers.id_MLDSA65_ECDSA_P256_SHA512, mlDsaKp.getPrivate(), ecPriv);
2909+
CompositePublicKey compPub = CompositePublicKey.builder(IANAObjectIdentifiers.id_MLDSA65_ECDSA_P256_SHA512)
2910+
.addPublicKey(mlDsaKp.getPublic(), "BC")
2911+
.addPublicKey(ecPub)
2912+
.build();
2913+
CompositePrivateKey compPrivKey = CompositePrivateKey.builder(IANAObjectIdentifiers.id_MLDSA65_ECDSA_P256_SHA512)
2914+
.addPrivateKey(mlDsaKp.getPrivate(), "BC")
2915+
.addPrivateKey(ecPriv)
2916+
.build();
29102917

29112918
ContentSigner sigGen = new JcaContentSignerBuilder("COMPOSITE").setProvider(BC).build(compPrivKey);
29122919

@@ -2941,6 +2948,8 @@ public void checkCRLCompositeCreation()
29412948

29422949
X509CRLHolder crlHolder = crlGen.build(sigGen);
29432950

2951+
isTrue(crlHolder.isSignatureValid(new JcaContentVerifierProviderBuilder().setProvider(BC).build(compPub)));
2952+
29442953
X509CRL crl = new JcaX509CRLConverter().setProvider(BC).getCRL(crlHolder);
29452954

29462955
// comp test
@@ -3141,6 +3150,44 @@ public void checkCrlECDSAwithDilithiumCreation()
31413150
}
31423151
}
31433152

3153+
public void checkMixedCompositionCreation()
3154+
throws Exception
3155+
{
3156+
if (Security.getProvider("SunEC") == null)
3157+
{
3158+
return;
3159+
}
3160+
KeyPairGenerator mldsaKpGen = KeyPairGenerator.getInstance("ML-DSA", "BC");
3161+
3162+
mldsaKpGen.initialize(MLDSAParameterSpec.ml_dsa_44);
3163+
3164+
KeyPair mldsaKp = mldsaKpGen.generateKeyPair();
3165+
3166+
KeyPairGenerator ecKpGen = KeyPairGenerator.getInstance("EC", "SunEC");
3167+
3168+
ecKpGen.initialize(new ECGenParameterSpec("secp256r1"));
3169+
3170+
KeyPair ecKp = ecKpGen.generateKeyPair();
3171+
3172+
CompositePublicKey compPublicKey = CompositePublicKey.builder(IANAObjectIdentifiers.id_MLDSA44_ECDSA_P256_SHA256)
3173+
.addPublicKey(mldsaKp.getPublic(), "BC")
3174+
.addPublicKey(ecKp.getPublic(), "BC")
3175+
.build();
3176+
CompositePrivateKey compPrivateKey = CompositePrivateKey.builder(IANAObjectIdentifiers.id_MLDSA44_ECDSA_P256_SHA256)
3177+
.addPrivateKey(mldsaKp.getPrivate(), "BC")
3178+
.addPrivateKey(ecKp.getPrivate(), "SunEC")
3179+
.build();
3180+
3181+
// First sign (and verify) a certificate
3182+
final ContentSigner certsigner = new BufferingContentSigner(new JcaContentSignerBuilder("MLDSA44-ECDSA-P256-SHA256").setProvider("BC").build(compPrivateKey), 4096);
3183+
final SubjectPublicKeyInfo pkinfo = SubjectPublicKeyInfo.getInstance(compPublicKey.getEncoded());
3184+
final X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(new X500Name("CN=issuer"), new BigInteger("12345678"), new Date(), new Date(), new X500Name("CN=subject"), pkinfo);
3185+
final X509CertificateHolder certHolder = certbuilder.build(certsigner);
3186+
//Assert.assertNotNull("signing must have created a certificate", certHolder);
3187+
final ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder().setProvider("BC").build(compPublicKey);
3188+
isTrue("Certificate signature must verify", certHolder.isSignatureValid(verifier));
3189+
}
3190+
31443191
/*
31453192
* we generate a self signed certificate for the sake of testing - GOST3410
31463193
*/
@@ -5465,25 +5512,25 @@ private void checkSerialisation()
54655512

54665513
// TESTS REGARDING COMPOSITES https://www.ietf.org/archive/id/draft-ounsworth-pq-composite-sigs-13.html
54675514
private static String[] compositeSignaturesOIDs = {
5468-
"1.3.6.1.5.5.7.6.37", // id_MLDSA44_RSA2048_PSS_SHA256
5469-
"1.3.6.1.5.5.7.6.38", // id_MLDSA44_RSA2048_PKCS15_SHA256
5470-
"1.3.6.1.5.5.7.6.39", // id_MLDSA44_Ed25519_SHA512
5471-
"1.3.6.1.5.5.7.6.40", // id_MLDSA44_ECDSA_P256_SHA256
5472-
"1.3.6.1.5.5.7.6.41", // id_MLDSA65_RSA3072_PSS_SHA512
5473-
"1.3.6.1.5.5.7.6.42", // id_MLDSA65_RSA3072_PKCS15_SHA512
5474-
"1.3.6.1.5.5.7.6.43", // id_MLDSA65_RSA4096_PSS_SHA512
5475-
"1.3.6.1.5.5.7.6.44", // id_MLDSA65_RSA4096_PKCS15_SHA512
5476-
"1.3.6.1.5.5.7.6.45", // id_MLDSA65_ECDSA_P256_SHA512
5477-
"1.3.6.1.5.5.7.6.46", // id_MLDSA65_ECDSA_P384_SHA512
5478-
"1.3.6.1.5.5.7.6.47", // id_MLDSA65_ECDSA_brainpoolP256r1_SHA512
5479-
"1.3.6.1.5.5.7.6.48", // id_MLDSA65_Ed25519_SHA512
5480-
"1.3.6.1.5.5.7.6.49", // id_MLDSA87_ECDSA_P384_SHA512
5481-
"1.3.6.1.5.5.7.6.50", // id_MLDSA87_ECDSA_brainpoolP384r1_SHA512
5482-
"1.3.6.1.5.5.7.6.51", // id_MLDSA87_Ed448_SHAKE256
5483-
"1.3.6.1.5.5.7.6.52", // id_MLDSA87_RSA3072_PSS_SHA512
5484-
"1.3.6.1.5.5.7.6.53", // id_MLDSA87_RSA4096_PSS_SHA512
5485-
"1.3.6.1.5.5.7.6.54" // id_MLDSA87_ECDSA_P521_SHA512
5486-
};
5515+
"1.3.6.1.5.5.7.6.37", // id_MLDSA44_RSA2048_PSS_SHA256
5516+
"1.3.6.1.5.5.7.6.38", // id_MLDSA44_RSA2048_PKCS15_SHA256
5517+
"1.3.6.1.5.5.7.6.39", // id_MLDSA44_Ed25519_SHA512
5518+
"1.3.6.1.5.5.7.6.40", // id_MLDSA44_ECDSA_P256_SHA256
5519+
"1.3.6.1.5.5.7.6.41", // id_MLDSA65_RSA3072_PSS_SHA512
5520+
"1.3.6.1.5.5.7.6.42", // id_MLDSA65_RSA3072_PKCS15_SHA512
5521+
"1.3.6.1.5.5.7.6.43", // id_MLDSA65_RSA4096_PSS_SHA512
5522+
"1.3.6.1.5.5.7.6.44", // id_MLDSA65_RSA4096_PKCS15_SHA512
5523+
"1.3.6.1.5.5.7.6.45", // id_MLDSA65_ECDSA_P256_SHA512
5524+
"1.3.6.1.5.5.7.6.46", // id_MLDSA65_ECDSA_P384_SHA512
5525+
"1.3.6.1.5.5.7.6.47", // id_MLDSA65_ECDSA_brainpoolP256r1_SHA512
5526+
"1.3.6.1.5.5.7.6.48", // id_MLDSA65_Ed25519_SHA512
5527+
"1.3.6.1.5.5.7.6.49", // id_MLDSA87_ECDSA_P384_SHA512
5528+
"1.3.6.1.5.5.7.6.50", // id_MLDSA87_ECDSA_brainpoolP384r1_SHA512
5529+
"1.3.6.1.5.5.7.6.51", // id_MLDSA87_Ed448_SHAKE256
5530+
"1.3.6.1.5.5.7.6.52", // id_MLDSA87_RSA3072_PSS_SHA512
5531+
"1.3.6.1.5.5.7.6.53", // id_MLDSA87_RSA4096_PSS_SHA512
5532+
"1.3.6.1.5.5.7.6.54" // id_MLDSA87_ECDSA_P521_SHA512
5533+
};
54875534

54885535
private static final String[] compositeSignaturesIDs = {
54895536
"MLDSA44-RSA2048-PSS-SHA256",
@@ -5532,7 +5579,7 @@ private void checkCompositeSignatureCertificateCreation()
55325579

55335580
isEquals(subjectName, cert.getSubjectX500Principal().getName());
55345581

5535-
cert.verify(cert.getPublicKey());
5582+
cert.verify(cert.getPublicKey(), "BC");
55365583
index++;
55375584
}
55385585
}
@@ -5723,6 +5770,7 @@ public void performTest()
57235770
checkCreationDilithiumSigWithECDSASig();
57245771

57255772
checkCreationComposite();
5773+
checkMixedCompositionCreation();
57265774
checkCompositeCertificateVerify();
57275775

57285776
createECCert("SHA1withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA1);

‎pkix/src/test/java/org/bouncycastle/cms/test/PQCSignedDataTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@
33
import java.io.ByteArrayInputStream;
44
import java.io.IOException;
55
import java.math.BigInteger;
6+
import java.security.KeyFactory;
67
import java.security.KeyPair;
78
import java.security.MessageDigest;
89
import java.security.SecureRandom;
910
import java.security.Security;
1011
import java.security.cert.CertificateException;
1112
import java.security.cert.CertificateFactory;
1213
import java.security.cert.X509Certificate;
14+
import java.security.spec.X509EncodedKeySpec;
1315
import java.util.ArrayList;
1416
import java.util.Collection;
1517
import java.util.Date;

‎prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ public final class BouncyCastleProvider extends Provider
7878
{
7979
private static final Logger LOG = Logger.getLogger(BouncyCastleProvider.class.getName());
8080

81-
private static String info = "BouncyCastle Security Provider v1.83b";
81+
private static String info = "BouncyCastle Security Provider v1.83";
8282

8383
public static final String PROVIDER_NAME = "BC";
8484

@@ -183,7 +183,7 @@ public final class BouncyCastleProvider extends Provider
183183
*/
184184
public BouncyCastleProvider()
185185
{
186-
super(PROVIDER_NAME, 1.8299, info);
186+
super(PROVIDER_NAME, 1.8300, info);
187187

188188
AccessController.doPrivileged(new PrivilegedAction()
189189
{

‎prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/BouncyCastlePQCProvider.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public class BouncyCastlePQCProvider
2222
extends Provider
2323
implements ConfigurableProvider
2424
{
25-
private static String info = "BouncyCastle Post-Quantum Security Provider v1.83b";
25+
private static String info = "BouncyCastle Post-Quantum Security Provider v1.83";
2626

2727
public static String PROVIDER_NAME = "BCPQC";
2828

@@ -51,7 +51,7 @@ public class BouncyCastlePQCProvider
5151
*/
5252
public BouncyCastlePQCProvider()
5353
{
54-
super(PROVIDER_NAME, 1.8299, info);
54+
super(PROVIDER_NAME, 1.83, info);
5555

5656
AccessController.doPrivileged(new PrivilegedAction()
5757
{

‎prov/src/main/jdk1.4/org/bouncycastle/jce/provider/BouncyCastleProvider.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
public final class BouncyCastleProvider extends Provider
5252
implements ConfigurableProvider
5353
{
54-
private static String info = "BouncyCastle Security Provider v1.82";
54+
private static String info = "BouncyCastle Security Provider v1.83";
5555

5656
public static final String PROVIDER_NAME = "BC";
5757

@@ -135,7 +135,7 @@ public final class BouncyCastleProvider extends Provider
135135
*/
136136
public BouncyCastleProvider()
137137
{
138-
super(PROVIDER_NAME, 1.8200, info);
138+
super(PROVIDER_NAME, 1.8300, info);
139139

140140
AccessController.doPrivileged(new PrivilegedAction()
141141
{

‎prov/src/test/java/org/bouncycastle/jcajce/provider/test/CompositeSignaturesTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -759,7 +759,7 @@ else if (tcId.contains("87"))
759759
MLDSAPublicKeySpec pubSpec = new MLDSAPublicKeySpec(((MLDSAPrivateKey)privKey).getParameterSpec(),
760760
((MLDSAPrivateKey)privKey).getPublicKey().getPublicData());
761761
pubKey = kFact.generatePublic(pubSpec);
762-
x5cpk = ((BCMLDSAPublicKey)cert.getPublicKey()).getPublicData();
762+
x5cpk = ((MLDSAPublicKey)cert.getPublicKey()).getPublicData();
763763
certPubKey = kFact.generatePublic(new MLDSAPublicKeySpec(((MLDSAPrivateKey)privKey).getParameterSpec(),
764764
x5cpk));
765765
}

‎tls/build.gradle‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,13 @@ sourceSets {
4848
}
4949
}
5050

51+
test25 {
52+
java {
53+
compileClasspath += main.output + test.output
54+
runtimeClasspath += test.output
55+
srcDir(files("src/test/jdk25"))
56+
}
57+
}
5158
}
5259

5360
dependencies {
@@ -63,10 +70,17 @@ dependencies {
6370
builtBy compileJava
6471
}
6572

73+
java25Implementation project(':prov')
74+
java25Implementation project(':util')
75+
java25Implementation project(':pkix')
76+
java25Implementation files([sourceSets.main.output.classesDirs, sourceSets.java9.output]) {
77+
builtBy compileJava
78+
}
79+
6680
test11Implementation group: 'junit', name: 'junit', version: '4.13.2'
6781
test15Implementation group: 'junit', name: 'junit', version: '4.13.2'
6882
test21Implementation group: 'junit', name: 'junit', version: '4.13.2'
69-
83+
test25Implementation group: 'junit', name: 'junit', version: '4.13.2'
7084

7185
test11Implementation project(':prov')
7286
test11Implementation project(':util')
@@ -80,6 +94,9 @@ dependencies {
8094
test21Implementation project(':util')
8195
test21Implementation project(':pkix')
8296

97+
test25Implementation project(':prov')
98+
test25Implementation project(':util')
99+
test25Implementation project(':pkix')
83100
}
84101

85102

@@ -124,6 +141,21 @@ compileTest21Java {
124141
options.sourcepath = files(['src/test/java', 'src/test/jdk21'])
125142
}
126143

144+
compileJava25Java {
145+
146+
options.release = 25
147+
148+
def prov_jar="${project(":prov").jar.outputs.files.getFiles().getAt(0)}"
149+
def util_jar="${project(":util").jar.outputs.files.getFiles().getAt(0)}"
150+
def pkix_jar="${project(":pkix").jar.outputs.files.getFiles().getAt(0)}"
151+
152+
153+
options.compilerArgs += [
154+
'--module-path', "${prov_jar}${File.pathSeparator}${util_jar}${File.pathSeparator}${pkix_jar}"
155+
]
156+
157+
options.sourcepath = files(['src/main/java', 'src/main/jdk25'])
158+
}
127159

128160

129161
task sourcesJar(type: Jar) {
@@ -144,6 +176,9 @@ jar {
144176
into('META-INF/versions/9') {
145177
from sourceSets.java9.output
146178
}
179+
into('META-INF/versions/25') {
180+
from sourceSets.java25.output
181+
}
147182
String v = "${rootProject.extensions.ext.bundle_version}"
148183
manifest.attributes('Multi-Release': 'true')
149184
manifest.attributes('Bundle-Name': 'bctls')
@@ -321,8 +356,8 @@ task test25(type: Test) {
321356
onlyIf {System.getenv("BC_JDK25") != null}
322357
dependsOn jar
323358

324-
testClassesDirs = sourceSets.test21.output.classesDirs
325-
classpath = sourceSets.test21.runtimeClasspath + files(jar.archiveFile)
359+
testClassesDirs = sourceSets.test25.output.classesDirs
360+
classpath = sourceSets.test25.runtimeClasspath + files(jar.archiveFile)
326361

327362
forkEvery = 1;
328363
maxParallelForks = 8;

0 commit comments

Comments
 (0)