oscerd opened a new pull request, #28093: URL: https://github.com/apache/camel/pull/28093
Fixes [CAMEL-25798](https://issues.apache.org/jira/browse/CAMEL-25798). ## Problem The three KEM operations disagreed about which name to stamp on the resulting secret key. `generateEncapsulation` passed the raw configuration value: ```java new KEMGenerateSpec( keyPair.getPublic(), getEndpoint().getConfiguration().getSymmetricKeyAlgorithm(), ``` while `extractEncapsulation` and `extractSecretKeyFromEncapsulation` both map it through the enum — the latter with a comment spelling out the rule that `generateEncapsulation` broke: ```java // Use the mapped JCE algorithm name (as extractEncapsulation does), not the raw enum name: for algorithms // whose enum name differs from the JCE name (for example GOST3412_2015 -> GOST3412-2015) the raw name is not a // resolvable cipher algorithm, so the restored key would carry an unusable algorithm label ``` Two of the eighteen constants differ: `GOST3412_2015("GOST3412-2015")` and `DESEDE("DESede")`. For those, the generate side produced a key labelled `DESEDE` / `GOST3412_2015` while the extract side produced `DESede` / `GOST3412-2015`. The generate-side label is not a resolvable cipher algorithm, so the key could not be passed to `Cipher.getInstance(key.getAlgorithm())` or handed to `CryptoDataFormat`, and the two ends of one exchange disagreed on the key's identity. The existing tests encoded both answers: `PQCMLKEMGenerateEncapsulationCryptoRoundTripDESedeTest` asserted `"DESEDE"` while `PQCExtractSecretKeyAlgorithmNameTest` asserted `"DESede"` for the same configured algorithm. ## Fix `generateEncapsulation` now uses `PQCSymmetricAlgorithms.valueOf(...).getAlgorithm()`, matching both siblings. It also gains the `symmetricKeyAlgorithm` guard the others already have. It was the only unguarded one of the five KEM paths — `validateSymmetricKeyLength` returns early when the algorithm is empty, so a null reached BouncyCastle and surfaced as an opaque `Missing argument`. ## Tests New `PQCGenerateEncapsulationAlgorithmNameTest`: - `generateAndExtractStampTheSameJceName` — asserts the generated label is the JCE name, that generate and extract agree, and that the stamped name actually resolves via `Cipher.getInstance`, which is the point of the change; - `aMissingSymmetricAlgorithmIsRejected`. Both fail against `main` (`expected: <DESede> but was: <DESEDE>`, and `Missing argument` instead of the clear message). `PQCMLKEMGenerateEncapsulationCryptoRoundTripDESedeTest` is updated to assert `PQCSymmetricAlgorithms.DESEDE.getAlgorithm()`, matching how the AES tests already assert. Full `camel-pqc` build green: 241 tests, 0 failures, no regenerated-file drift. ## Upgrade guide Added a 4.24 entry — the label change is user-visible for `DESEDE` and `GOST3412_2015`, and code asserting on the old value needs updating. --- _Reported, analysed and fixed by Claude Code (AI agent) on behalf of @oscerd._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
