gnodet-bot commented on code in PR #27768:
URL: https://github.com/apache/camel/pull/27768#discussion_r4256727770
##########
components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java:
##########
@@ -625,41 +635,75 @@ private static byte[] bodyToByteArray(Message message)
throws InvalidPayloadExce
}
}
+ /**
+ * Returns the KEM {@link KeyGenerator} to use for a single exchange.
+ * <p>
+ * A KEM {@code KeyGenerator} keeps the spec passed to {@code init()}
until {@code generateKey()} reads it and is
+ * not thread-safe, so the two calls of one exchange must not interleave
with those of another. As with
+ * {@link #signerForExchange()}, an instance this producer created is
simply created again, while a configured one -
+ * an autowired bean can be shared by every endpoint, and {@code
PQCDefault*Material.keyGenerator} JVM-wide - is
+ * handed back as-is, and the caller serializes on whatever it gets.
+ */
+ private KeyGenerator keyGeneratorForExchange() throws
NoSuchAlgorithmException {
+ if (keyGeneratorAlgorithm == null) {
+ return keyGenerator;
+ }
+ return KeyGenerator.getInstance(keyGeneratorAlgorithm,
keyGeneratorProvider);
+ }
+
+ /**
+ * The {@link KeyAgreement} counterpart of {@link
#keyGeneratorForExchange()}, used by the hybrid KEM operations.
+ */
+ private KeyAgreement classicalKeyAgreementForExchange() throws
NoSuchAlgorithmException {
+ if (classicalKeyAgreementAlgorithm == null) {
+ return classicalKeyAgreement;
+ }
+ return KeyAgreement.getInstance(classicalKeyAgreementAlgorithm);
+ }
Review Comment:
💡 **Nit:** `classicalKeyAgreementForExchange()` creates a new `KeyAgreement`
via `getInstance(algorithm)` without saving the provider, unlike
`keyGeneratorForExchange()` which saves `keyGeneratorProvider`. This is
intentionally correct — classical KA algorithms (X25519, ECDH) come from
JDK-bundled providers (SunEC), not from Bouncy Castle which
`PQCEndpoint.doStop()` removes from the JVM. Add a brief comment so a future
maintainer doesn't "fix" it to match `keyGeneratorForExchange()` and
accidentally hard-wire a BC provider for classical algorithms.
```suggestion
private KeyAgreement classicalKeyAgreementForExchange() throws
NoSuchAlgorithmException {
if (classicalKeyAgreementAlgorithm == null) {
return classicalKeyAgreement;
}
// No provider saved: classical KA algorithms (X25519, ECDH) come
from JDK-bundled providers,
// not from Bouncy Castle — so no BC provider to preserve across
PQCEndpoint.doStop().
return KeyAgreement.getInstance(classicalKeyAgreementAlgorithm);
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
