gnodet-bot commented on code in PR #27500:
URL: https://github.com/apache/camel/pull/27500#discussion_r4208201603
##########
components/camel-pqc/src/main/docs/pqc-key-lifecycle.adoc:
##########
@@ -1202,22 +1202,27 @@ The lifecycle manager provides sensible defaults for
all algorithms:
|===
|Algorithm |Default Parameter Spec
-|DILITHIUM |dilithium2
+|DILITHIUM |ML-DSA-44
|FALCON |falcon_512
-|SPHINCSPLUS |sha2_128s
+|SPHINCSPLUS |SLH-DSA-SHA2-128S
|XMSS |10-tree height with SHA-256
|XMSSMT |XMSSMT-SHA2-20d2-256
|LMS/HSS |LMS-SHA256-N32-H10 with SHA256-N32-W4
|NTRU |ntruhps2048509
|NTRULPRime |ntrulpr653
|SNTRUPrime |sntrup761
|SABER |lightsaberkem128r3
-|FRODO |frodokem640aes
+|FRODO |frodokem976aes
|BIKE |bike128
|HQC |hqc128
-|CMCE |mceliece348864
+|CMCE |mceliece460896
|===
+NOTE: With Bouncy Castle 1.86, CMCE and FRODO use the `BC` provider instead of
`BCPQC`. The lifecycle manager defaults
Review Comment:
⚠️ **Migration NOTE incomplete — DILITHIUM/SPHINCSPLUS also changed:** This
NOTE covers CMCE and FRODO, but DILITHIUM and SPHINCSPLUS underwent the same
provider switch (`BCPQC` → `BC`) and parameter-name change (`dilithium2` →
`ML-DSA-44`, `sha2_128s` → `SLH-DSA-SHA2-128S`). Stored keys generated with the
old `DilithiumParameterSpec`/`SPHINCSPlusParameterSpec` constants need to be
regenerated and peers updated — the same warning that CMCE/FRODO users get.
Suggest extending this NOTE (or adding a parallel one) to mention both
algorithms.
##########
components/camel-pqc/src/main/docs/pqc-component.adoc:
##########
@@ -91,17 +93,16 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an
alias of the canonical na
| `MLKEM` | `ML-KEM-512` (default), `ML-KEM-768`, `ML-KEM-1024`
| `SLHDSA` | `SLH-DSA-SHA2-128S`, `SLH-DSA-SHAKE-256F`, ... (see
`SLHDSAParameterSpec`)
| `FALCON` | `FALCON-512`, `FALCON-1024`
-| `DILITHIUM` | `DILITHIUM2`, `DILITHIUM3`, `DILITHIUM5`
-| `SPHINCSPLUS` | `sha2-128s`, ... (see `SPHINCSPlusParameterSpec`)
-| `PICNIC` | `picnicl1fs`, ... (see `PicnicParameterSpec`)
-| `KYBER` | `kyber512`, `kyber768`, `kyber1024`
+| `DILITHIUM` | `ML-DSA-44`, `ML-DSA-65`, `ML-DSA-87` (default)
Review Comment:
⚠️ **Dual-default ambiguity for DILITHIUM:** The lifecycle-manager defaults
table (`pqc-key-lifecycle.adoc`, line 1205) uses `ML-DSA-44` as the DILITHIUM
lifecycle default, but this row says `ML-DSA-87 (default)` — the component
default. CMCE already uses the `(lifecycle manager default)` / `(component
default)` annotation pattern to disambiguate. Suggest the same here:
```suggestion
| `DILITHIUM` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65`,
`ML-DSA-87` (component default)
```
##########
components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java:
##########
@@ -94,6 +131,17 @@ void testUnknownParameterSpecRejected() {
assertTrue(e.getMessage().contains("Unknown parameterSpec"));
}
+ @Test
+ void testParameterSetsDroppedByBouncyCastleRejected() {
+ // The Classic McEliece and FrodoKEM specs of the BC provider have no
mceliece348864 or frodokem640 sets
+ IllegalArgumentException cmce =
assertThrows(IllegalArgumentException.class,
+ () -> PQCParameterSpecResolver.resolve("CMCE",
"mceliece348864"));
+ assertTrue(cmce.getMessage().contains("Unknown parameterSpec"));
+ IllegalArgumentException frodo =
assertThrows(IllegalArgumentException.class,
+ () -> PQCParameterSpecResolver.resolve("FRODO",
"frodokem640aes"));
+ assertTrue(frodo.getMessage().contains("Unknown parameterSpec"));
+ }
Review Comment:
⚠️ **Missing rejection coverage for old DILITHIUM parameter names:** This
test guards against old CMCE and FRODO spec names, but DILITHIUM also renamed
its parameters — `dilithium2` (and upper-case `DILITHIUM2`) are no longer valid
with `MLDSAParameterSpec`. Suggest adding:
```java
IllegalArgumentException dilithium =
assertThrows(IllegalArgumentException.class,
() -> PQCParameterSpecResolver.resolve("DILITHIUM",
"dilithium2"));
assertTrue(dilithium.getMessage().contains("Unknown parameterSpec"));
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
