On Fri, 30 Oct 2026 08:05:56 GMT, Hai-May Chao <[email protected]> wrote:
>> This feature enables SunJSSE to use a TLS 1.3 hybrid named group implemented >> directly by a security provider as JCA `KeyPairGenerator` and `KEM` >> services. It also moves the JDK implementations of `X25519MLKEM768`, >> SecP256r1MLKEM768, and `SecP384r1MLKEM1024` into SunJCE provider. >> >> --------- >> - [X] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Hai-May Chao has updated the pull request incrementally with one additional > commit since the last revision: > > Remove unused adapter from DHasKEM src/java.base/share/classes/sun/security/ssl/Hybrid.java line 73: > 71: // For the negotiated shared secret represented as a SecretKey, > getFormat() > 72: // must return "RAW", and getEncoded() must return the combined key > material > 73: // as a byte array. The last paragraph is no longer true for us. A third-party provider is free to decide what their shared secret looks like. If they also need a `null` format, they would have to provide their own HKDF implementations that accept it. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4423882615
