This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 13a45678a466 CAMEL-25805: camel-pqc - validate the CamelPQCOperation
header instead of dereferencing a null (#28104)
13a45678a466 is described below
commit 13a45678a4666a9e9982ca78b034db3be97e1906
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Oct 21 10:27:32 2026 +0200
CAMEL-25805: camel-pqc - validate the CamelPQCOperation header instead of
dereferencing a null (#28104)
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../org/apache/camel/catalog/components/pqc.json | 4 +-
.../org/apache/camel/component/pqc/pqc.json | 4 +-
.../apache/camel/component/pqc/PQCConstants.java | 6 +-
.../apache/camel/component/pqc/PQCProducer.java | 53 ++++++++-
.../pqc/PQCOperationHeaderOverrideTest.java | 121 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 13 +++
.../endpoint/dsl/PQCEndpointBuilderFactory.java | 9 +-
7 files changed, 198 insertions(+), 12 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
index 40d2efc491c6..39a2d8dc3ff6 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
@@ -57,10 +57,10 @@
"healthCheckProducerEnabled": { "index": 30, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
},
"headers": {
- "CamelPQCOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The operation we want to perform", "constantName":
"org.apache.camel.component.pqc.PQCConstants#OPERATION" },
+ "CamelPQCOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"org.apache.camel.component.pqc.PQCOperations", "enum": [ "sign", "verify",
"hybridSign", "hybridVerify", "generateSecretKeyEncapsulation",
"extractSecretKeyEncapsulation", "extractSecretKeyFromEncapsulation",
"hybridGenerateSecretKeyEncapsulation", "hybridExtractSecretKeyEncapsulation",
"hybridExtractSecretKeyFromEncapsulation", "getRemainingSignat [...]
"CamelPQCSignature": { "index": 1, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The signature of a body", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SIGNATURE" },
"CamelPQCVerification": { "index": 2, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "Boolean",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The result of verification of a Body signature",
"constantName": "org.apache.camel.component.pqc.PQCConstants#VERIFY" },
- "CamelPQCSecretKey": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "Boolean",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The extracted key in case of
extractSecretKeyFromEncapsulation operation and storeExtractedSecretKeyAsHeader
option enabled", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SECRET_KEY" },
+ "CamelPQCSecretKey": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"javax.crypto.SecretKey", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "description": "The extracted key in case
of extractSecretKeyFromEncapsulation operation and
storeExtractedSecretKeyAsHeader option enabled", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SECRET_KEY" },
"CamelPQCRemainingSignatures": { "index": 4, "kind": "header",
"displayName": "", "group": "producer", "label": "", "required": false,
"javaType": "Long", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The remaining signatures for a stateful
key", "constantName":
"org.apache.camel.component.pqc.PQCConstants#REMAINING_SIGNATURES" },
"CamelPQCKeyState": { "index": 5, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"org.apache.camel.component.pqc.stateful.StatefulKeyState", "deprecated":
false, "deprecationNote": "", "autowired": false, "secret": false,
"description": "The key state for a stateful key", "constantName":
"org.apache.camel.component.pqc.PQCConstants#KEY_STATE" },
"CamelPQCKeyId": { "index": 6, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The key ID for stateful key operations", "constantName":
"org.apache.camel.component.pqc.PQCConstants#KEY_ID" },
diff --git
a/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
b/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
index 40d2efc491c6..39a2d8dc3ff6 100644
---
a/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
+++
b/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
@@ -57,10 +57,10 @@
"healthCheckProducerEnabled": { "index": 30, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
},
"headers": {
- "CamelPQCOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The operation we want to perform", "constantName":
"org.apache.camel.component.pqc.PQCConstants#OPERATION" },
+ "CamelPQCOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"org.apache.camel.component.pqc.PQCOperations", "enum": [ "sign", "verify",
"hybridSign", "hybridVerify", "generateSecretKeyEncapsulation",
"extractSecretKeyEncapsulation", "extractSecretKeyFromEncapsulation",
"hybridGenerateSecretKeyEncapsulation", "hybridExtractSecretKeyEncapsulation",
"hybridExtractSecretKeyFromEncapsulation", "getRemainingSignat [...]
"CamelPQCSignature": { "index": 1, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The signature of a body", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SIGNATURE" },
"CamelPQCVerification": { "index": 2, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "Boolean",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The result of verification of a Body signature",
"constantName": "org.apache.camel.component.pqc.PQCConstants#VERIFY" },
- "CamelPQCSecretKey": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "Boolean",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The extracted key in case of
extractSecretKeyFromEncapsulation operation and storeExtractedSecretKeyAsHeader
option enabled", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SECRET_KEY" },
+ "CamelPQCSecretKey": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"javax.crypto.SecretKey", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "description": "The extracted key in case
of extractSecretKeyFromEncapsulation operation and
storeExtractedSecretKeyAsHeader option enabled", "constantName":
"org.apache.camel.component.pqc.PQCConstants#SECRET_KEY" },
"CamelPQCRemainingSignatures": { "index": 4, "kind": "header",
"displayName": "", "group": "producer", "label": "", "required": false,
"javaType": "Long", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The remaining signatures for a stateful
key", "constantName":
"org.apache.camel.component.pqc.PQCConstants#REMAINING_SIGNATURES" },
"CamelPQCKeyState": { "index": 5, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType":
"org.apache.camel.component.pqc.stateful.StatefulKeyState", "deprecated":
false, "deprecationNote": "", "autowired": false, "secret": false,
"description": "The key state for a stateful key", "constantName":
"org.apache.camel.component.pqc.PQCConstants#KEY_STATE" },
"CamelPQCKeyId": { "index": 6, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The key ID for stateful key operations", "constantName":
"org.apache.camel.component.pqc.PQCConstants#KEY_ID" },
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConstants.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConstants.java
index f99a57a23abf..73b463acff9b 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConstants.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConstants.java
@@ -22,7 +22,9 @@ import org.apache.camel.spi.Metadata;
* Constants used in PQC module
*/
public interface PQCConstants {
- @Metadata(description = "The operation we want to perform", javaType =
"String")
+ @Metadata(description = "The operation we want to perform. It must be one
the endpoint holds the key material for:"
+ + " an override crossing between the signature and
the key encapsulation operations is rejected",
+ javaType = "org.apache.camel.component.pqc.PQCOperations")
String OPERATION = "CamelPQCOperation";
@Metadata(description = "The signature of a body", javaType = "String")
@@ -32,7 +34,7 @@ public interface PQCConstants {
String VERIFY = "CamelPQCVerification";
@Metadata(description = "The extracted key in case of
extractSecretKeyFromEncapsulation operation and storeExtractedSecretKeyAsHeader
option enabled",
- javaType = "Boolean")
+ javaType = "javax.crypto.SecretKey")
String SECRET_KEY = "CamelPQCSecretKey";
@Metadata(description = "The remaining signatures for a stateful key",
javaType = "Long")
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
index 9b24ae434c30..53a42d5eb188 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
@@ -228,7 +228,7 @@ public class PQCProducer extends DefaultProducer {
statefulDeleteKeyState(exchange);
break;
default:
- throw new IllegalArgumentException("Unsupported
operation");
+ throw new IllegalArgumentException("Unsupported operation:
" + operation);
}
success = true;
} finally {
@@ -239,11 +239,56 @@ public class PQCProducer extends DefaultProducer {
private PQCOperations determineOperation(Exchange exchange) {
PQCOperations operation =
exchange.getIn().getHeader(PQCConstants.OPERATION, PQCOperations.class);
if (operation == null) {
- operation = getConfiguration().getOperation();
+ return getConfiguration().getOperation();
}
+ checkOperationIsUsable(operation);
return operation;
}
+ /**
+ * Rejects a {@link PQCConstants#OPERATION} header selecting an operation
this producer has no resources for.
+ * <p/>
+ * {@link #doStart()} builds the {@code Signature} only for the signature
operations and the {@code KeyGenerator}
+ * only for the KEM ones, and the key material is autowired for whichever
algorithm option the endpoint declares. An
+ * override that crosses from one family to the other would otherwise
dereference a null and surface as a bare
+ * NullPointerException deep inside the operation.
+ */
+ private void checkOperationIsUsable(PQCOperations operation) {
+ String missing = null;
+ switch (operation) {
+ case sign, verify -> missing = signer == null ? "a Signature" :
null;
+ case hybridSign, hybridVerify -> {
+ if (signer == null) {
+ missing = "a Signature";
+ } else if (classicalSigner == null) {
+ missing = "a classical Signature";
+ }
+ }
+ case generateSecretKeyEncapsulation, extractSecretKeyEncapsulation
->
+ missing = keyGenerator == null ? "a KeyGenerator" : null;
+ case hybridGenerateSecretKeyEncapsulation,
hybridExtractSecretKeyEncapsulation -> {
+ if (keyGenerator == null) {
+ missing = "a KeyGenerator";
+ } else if (classicalKeyAgreement == null) {
+ missing = "a classical KeyAgreement";
+ }
+ }
+ default -> {
+ // the remaining operations work off the exchange payload or
the KeyLifecycleManager
+ }
+ }
+
+ if (missing != null) {
+ throw new IllegalArgumentException(
+ "The " + PQCConstants.OPERATION + " header requests
operation '" + operation
+ + "', but this endpoint is
configured for '"
+ +
getConfiguration().getOperation()
+ + "' and so holds no " + missing
+ + " for it. Configure a
separate endpoint for that operation, or set"
+ + " the matching algorithm and
key material on this one.");
+ }
+ }
+
protected PQCConfiguration getConfiguration() {
return getEndpoint().getConfiguration();
}
@@ -1274,7 +1319,9 @@ public class PQCProducer extends DefaultProducer {
classicalAlg);
}
} catch (IllegalArgumentException e) {
- // Unknown classical algorithm - will fail later during
init
+ // Not fatal here: the endpoint may still be configured
with explicit classical key material.
+ // It is logged because otherwise a typo surfaces much
later as an opaque initialisation failure.
+ LOG.debug("Unknown classical signature algorithm '{}',
skipping its advisory checks", classicalAlg, e);
}
}
String pqcAlg = config.getSignatureAlgorithm();
diff --git
a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCOperationHeaderOverrideTest.java
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCOperationHeaderOverrideTest.java
new file mode 100644
index 000000000000..30e801b507f8
--- /dev/null
+++
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCOperationHeaderOverrideTest.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.pqc;
+
+import java.security.Security;
+
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.EndpointInject;
+import org.apache.camel.Produce;
+import org.apache.camel.ProducerTemplate;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.pqc.jcajce.provider.BouncyCastlePQCProvider;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * The documented CamelPQCOperation header may only select an operation the
endpoint actually holds resources for.
+ * Crossing from the signature family to the key encapsulation family used to
dereference a null KeyGenerator.
+ */
+public class PQCOperationHeaderOverrideTest extends CamelTestSupport {
+
+ @EndpointInject("mock:out")
+ protected MockEndpoint result;
+
+ @Produce("direct:sign")
+ protected ProducerTemplate template;
+
+ @BeforeEach
+ void addProviders() {
+ if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
+ Security.addProvider(new BouncyCastleProvider());
+ }
+ if (Security.getProvider(BouncyCastlePQCProvider.PROVIDER_NAME) ==
null) {
+ Security.addProvider(new BouncyCastlePQCProvider());
+ }
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("direct:sign")
+ .to("pqc:sign?operation=sign&signatureAlgorithm=MLDSA")
+ .to("mock:out");
+ }
+ };
+ }
+
+ @Test
+ void anOverrideCrossingToTheKemFamilyIsRejectedWithAClearMessage() {
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () -> template.sendBodyAndHeader("direct:sign", "Hello",
+ PQCConstants.OPERATION,
PQCOperations.generateSecretKeyEncapsulation));
+
+ Throwable cause = e.getCause();
+ assertInstanceOf(IllegalArgumentException.class, cause,
+ "expected a configuration error, not a NullPointerException: "
+ cause);
+
+ String message = cause.getMessage();
+ assertTrue(message.contains("generateSecretKeyEncapsulation"), "must
name the requested operation: " + message);
+ assertTrue(message.contains("configured for 'sign'"), "must name the
configured operation: " + message);
+ assertTrue(message.contains("KeyGenerator"), "must name what is
missing: " + message);
+ }
+
+ @Test
+ void anOverrideToTheConfiguredOperationStillWorks() throws Exception {
+ result.expectedMessageCount(1);
+
+ template.sendBodyAndHeader("direct:sign", "Hello",
PQCConstants.OPERATION, PQCOperations.sign);
+
+ result.assertIsSatisfied();
+
assertNotNull(result.getExchanges().get(0).getMessage().getHeader(PQCConstants.SIGNATURE,
byte[].class));
+ }
+
+ @Test
+ void anOverrideToAnOperationNeedingNoKeyMaterialIsAllowed() {
+ // getKeyState needs no key material beyond the key pair, so the
signature-only endpoint may serve it: the
+ // override is accepted and the operation itself then rejects the
non-stateful ML-DSA key
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () -> template.sendBodyAndHeader("direct:sign", "Hello",
+ PQCConstants.OPERATION, PQCOperations.getKeyState));
+
+ Throwable cause = e.getCause();
+ assertInstanceOf(IllegalArgumentException.class, cause);
+ assertTrue(cause.getMessage().contains("getKeyState is only supported
for stateful signature schemes"),
+ "the override must be accepted and fail inside the operation:
" + cause.getMessage());
+ }
+
+ @Test
+ void noHeaderUsesTheConfiguredOperation() throws Exception {
+ result.expectedMessageCount(1);
+
+ template.sendBody("direct:sign", "Hello");
+
+ result.assertIsSatisfied();
+
assertNotNull(result.getExchanges().get(0).getMessage().getHeader(PQCConstants.SIGNATURE,
byte[].class));
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index 6e83564fcea8..f5d645009ea4 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -331,6 +331,19 @@ model better at tool calling, such as `qwen3.6`, is
installed.
`bean`). Scripts that read the `REMOTE` column of the table must read `SCOPE`
instead. The `--json` output keeps
`remote` and adds `internal`.
+=== camel-pqc - the CamelPQCOperation header is validated, and two header
types are corrected
+
+A `CamelPQCOperation` header selecting an operation the endpoint holds no key
material for is now rejected with an
+`IllegalArgumentException` naming the requested operation, the configured one,
and what is missing. Before, an
+override crossing between the signature and the key encapsulation operations
dereferenced a null and surfaced as a
+bare `NullPointerException`. Routes relying on such an override have to
configure a separate endpoint for the other
+operation; the override itself keeps working within a family and for the
operations that need no key material.
+
+Two header declarations also carried the wrong `javaType` in the component
metadata, which is visible to tooling and
+in the generated header table. `CamelPQCOperation` is
`org.apache.camel.component.pqc.PQCOperations` (was `String`)
+and `CamelPQCSecretKey` is `javax.crypto.SecretKey` (was `Boolean`). The
runtime values are unchanged - only the
+declared types were wrong.
+
=== camel-jbang - finding integrations by name or PID
All commands find running integrations the same way:
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
index ecb5438519a1..54e93ff2eeb5 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
@@ -725,9 +725,12 @@ public interface PQCEndpointBuilderFactory {
public static final PQCHeaderNameBuilder INSTANCE = new
PQCHeaderNameBuilder();
/**
- * The operation we want to perform.
+ * The operation we want to perform. It must be one the endpoint holds
+ * the key material for: an override crossing between the signature and
+ * the key encapsulation operations is rejected.
*
- * The option is a: {@code String} type.
+ * The option is a: {@code
org.apache.camel.component.pqc.PQCOperations}
+ * type.
*
* Group: producer
*
@@ -764,7 +767,7 @@ public interface PQCEndpointBuilderFactory {
* The extracted key in case of extractSecretKeyFromEncapsulation
* operation and storeExtractedSecretKeyAsHeader option enabled.
*
- * The option is a: {@code Boolean} type.
+ * The option is a: {@code javax.crypto.SecretKey} type.
*
* Group: producer
*
