[
https://issues.apache.org/jira/browse/CAMEL-26545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26545 started by Andrea Cosentino.
------------------------------------------------
> the post-quantum named group auto-configuration races on a shared
> SSLContextParameters and only looks for X25519MLKEM768
> ------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26545
> URL: https://issues.apache.org/jira/browse/CAMEL-26545
> Project: Camel
> Issue Type: Bug
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> Three defects in {{SSLContextParameters.applyPqcNamedGroupDefaults()}}
> (core/camel-api, {{org.apache.camel.support.jsse}}):
> 1. *Race on shared state.* The method configures the preference by mutating
> the bean itself - {{setNamedGroups(...)}} - and resets it in a {{finally}}
> block once the configurers have been built. There is no synchronization, and
> a global {{SSLContextParameters}} is shared by every component in the
> context. Two concurrent {{createSSLContext()}} calls can interleave so that
> one caller skips the auto-configuration (it observed the other thread's
> value) or builds its configurers after the other thread's reset. The result
> is a post-quantum preference that is applied or not depending on timing.
> 2. *Only one hybrid group is probed.* The detection tests for
> {{X25519MLKEM768}} only. A JVM or a crypto policy that offers
> {{SecP256r1MLKEM768}} or {{SecP384r1MLKEM1024}} but not the X25519 hybrid
> gets no post-quantum preference at all.
> 3. *No signal when it does not apply.* The method logs at INFO when it
> configures the groups and says nothing when no post-quantum group is
> available, so on a JDK that does not offer one there is no way to tell the
> feature is dormant short of {{-Djavax.net.debug}}.
> Fix: compute the ordering into a local value and pass it to the configurers
> without touching instance state, extend the probe to the NIST hybrids, and
> log once when no post-quantum group is available.
> Out of scope here, as a separate improvement: a fail-fast "require
> post-quantum" option tied to {{camel.main.profile=prod}}.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
