oscerd commented on code in PR #29094:
URL: https://github.com/apache/camel/pull/29094#discussion_r4478074514
##########
components/camel-mina-sftp/src/main/docs/mina-sftp-security.adoc:
##########
@@ -194,12 +194,53 @@
from("mina-sftp://user@host/path?password=secret&keyExchangeProtocols=curve25519
.to("file:local");
----
+=== Post-Quantum Key Exchange
+
+The hybrid post-quantum key exchanges are proposed to any server that offers
them, with no configuration, so a
+connection is protected against harvest-now-decrypt-later attacks by default.
They are implemented through Bouncy
+Castle, which `camel-mina-sftp` brings on the classpath.
+
+`sshd-core` proposes `sntrup761x25519-sha512` first, under its name and under
its `[email protected]`
+alias, and the ML-KEM groups after it. A server that offers both, such as
OpenSSH 9.9 or later, therefore negotiates
+`sntrup761x25519-sha512` rather than ML-KEM, and an OpenSSH server before 9.9
offers only the alias. To prefer ML-KEM,
+put `mlkem768x25519-sha256` first in `keyExchangeProtocols`.
+
+Note that `keyExchangeProtocols` *replaces* the proposal rather than adding to
it: an endpoint that pins a list of
+classical algorithms never negotiates a post-quantum one. Check any value
configured before Camel 4.24. To require
+the post-quantum exchange, and fail rather than fall back, pin the proposal to
the hybrids alone:
+
+[source,java]
+----
+from("mina-sftp://user@host/path?password=secret&keyExchangeProtocols=mlkem768x25519-sha256,sntrup761x25519-sha512,[email protected]";)
+ .to("file:local");
+----
+
Review Comment:
Added in 6a4c4ac9ba7a: the "Post-Quantum Key Exchange" section of the
mina-sftp page now carries the same note as the upgrade guide, after the
example, with the `-Dorg.apache.sshd.security.provider.BC.enabled=false`
opt-out; catalog copy updated.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
