[
https://issues.apache.org/jira/browse/CAMEL-26548?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-26548:
--------------------------------
Fix Version/s: 4.24.0
> camel-pqc - symmetricKeyLength defaults to 128, which undercuts the security
> category of the default KEM
> --------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26548
> URL: https://issues.apache.org/jira/browse/CAMEL-26548
> Project: Camel
> Issue Type: Improvement
> Components: camel-pqc
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> {{PQCConfiguration.symmetricKeyLength}} and the {{pqc}} data format both
> default to 128.
> The default KEM is ML-KEM, whose default parameter set is ML-KEM-768 - NIST
> category 3, a 256-bit shared secret. Deriving a 128-bit AES key from it
> throws that margin away and does not meet CNSA 2.0, which requires AES-256.
> The signature side already defaults consistently ({{ml_dsa_65}}).
> Change the default to 256 in {{PQCConfiguration}} and in the data format
> model, regenerate the catalog, and add an upgrade-guide entry: this is a
> changed default, and a route that marshals with the old default and
> unmarshals with the new one must pin {{symmetricKeyLength=128}} explicitly.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
