This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 24b6a0ac7883 CAMEL-25802: camel-pqc - align the key material classes
and correct two false premises (#28106)
24b6a0ac7883 is described below
commit 24b6a0ac7883c674895dd66b1ee7cf81096d29b0
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 20 21:02:49 2026 +0200
CAMEL-25802: camel-pqc - align the key material classes and correct two
false premises (#28106)
Co-Authored-By: Claude Opus 5 <[email protected]>
---
.../org/apache/camel/catalog/components/pqc.json | 4 +-
.../apache/camel/catalog/docs/pqc-component.adoc | 8 +-
.../org/apache/camel/component/pqc/pqc.json | 4 +-
.../camel-pqc/src/main/docs/pqc-component.adoc | 8 +-
.../camel/component/pqc/PQCConfiguration.java | 4 +-
.../component/pqc/PQCParameterSpecResolver.java | 49 +++++---
.../apache/camel/component/pqc/PQCProducer.java | 10 +-
.../pqc/crypto/PQCDefaultFalconMaterial.java | 3 +-
.../pqc/crypto/PQCDefaultHSSMaterial.java | 3 +-
.../pqc/crypto/PQCDefaultLMSMaterial.java | 4 +-
.../pqc/crypto/PQCDefaultMAYOMaterial.java | 3 +-
.../pqc/crypto/PQCDefaultSNOVAMaterial.java | 3 +-
.../component/pqc/PQCMaterialConsistencyTest.java | 132 +++++++++++++++++++++
.../pqc/PQCParameterSpecResolverTest.java | 7 +-
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 15 +++
.../component/dsl/PqcComponentBuilderFactory.java | 6 +-
.../endpoint/dsl/PQCEndpointBuilderFactory.java | 6 +-
17 files changed, 223 insertions(+), 46 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
index 6a74385545ed..40d2efc491c6 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/pqc.json
@@ -45,7 +45,7 @@
"keyRotationSchedulerEnabled": { "index": 18, "kind": "property",
"displayName": "Key Rotation Scheduler Enabled", "group": "advanced", "label":
"advanced", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue":
false, "description": "Whether to start an automated background key rotation
scheduler for this component. Requires keyLifecycleManager to be set. The
scheduler periodically rotates keys that exce [...]
"keyStore": { "index": 19, "kind": "property", "displayName": "Key Store",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.KeyStore", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "A KeyStore where we could get Cryptographic
material" },
"keyStorePassword": { "index": 20, "kind": "property", "displayName": "Key
Store Password", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The KeyStore password to use in combination
with KeySto [...]
- "parameterSpec": { "index": 21, "kind": "property", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
+ "parameterSpec": { "index": 21, "kind": "property", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
"signatureAlgorithm": { "index": 22, "kind": "property", "displayName":
"Signature Algorithm", "group": "advanced", "label": "advanced", "required":
false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLDSA",
"SLHDSA", "LMS", "HSS", "XMSS", "XMSSMT", "DILITHIUM", "FALCON", "SNOVA",
"MAYO", "SPHINCSPLUS" ], "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurati [...]
"signer": { "index": 23, "kind": "property", "displayName": "Signer",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.Signature", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The Signer to be used" },
"statefulKeyWarningThreshold": { "index": 24, "kind": "property",
"displayName": "Stateful Key Warning Threshold", "group": "advanced", "label":
"advanced", "required": false, "type": "number", "javaType": "double",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "defaultValue": 0.1, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The warning threshold for stateful key exh
[...]
@@ -98,7 +98,7 @@
"keyPairAlias": { "index": 13, "kind": "parameter", "displayName": "Key
Pair Alias", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "A KeyPair alias to use
in combination with KeyStore parameter" },
"keyStore": { "index": 14, "kind": "parameter", "displayName": "Key
Store", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "java.security.KeyStore", "deprecated": false,
"deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "A KeyStore where we
could get Cryptographic material" },
"keyStorePassword": { "index": 15, "kind": "parameter", "displayName":
"Key Store Password", "group": "advanced", "label": "advanced", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The KeyStore password to use in combination
with KeySt [...]
- "parameterSpec": { "index": 16, "kind": "parameter", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
+ "parameterSpec": { "index": 16, "kind": "parameter", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
"signatureAlgorithm": { "index": 17, "kind": "parameter", "displayName":
"Signature Algorithm", "group": "advanced", "label": "advanced", "required":
false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLDSA",
"SLHDSA", "LMS", "HSS", "XMSS", "XMSSMT", "DILITHIUM", "FALCON", "SNOVA",
"MAYO", "SPHINCSPLUS" ], "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurat [...]
"signer": { "index": 18, "kind": "parameter", "displayName": "Signer",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.Signature", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The Signer to be used" },
"statefulKeyWarningThreshold": { "index": 19, "kind": "parameter",
"displayName": "Stateful Key Warning Threshold", "group": "advanced", "label":
"advanced", "required": false, "type": "number", "javaType": "double",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "defaultValue": 0.1, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The warning threshold for stateful key ex [...]
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
index 136728d35fc4..91840a7ae7b4 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/pqc-component.adoc
@@ -95,6 +95,8 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an alias
of the canonical na
| `FALCON` | `FALCON-512`, `FALCON-1024`
| `DILITHIUM` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65`,
`ML-DSA-87` (component default)
| `SPHINCSPLUS` | The `SLHDSA` parameter sets, for example `SLH-DSA-SHA2-128S`
(default)
+| `MAYO` | `mayo1`, `mayo2`, `mayo3`, `mayo5` (default); the canonical dashed
form (`MAYO-1`) is accepted too
+| `SNOVA` | `SNOVA_24_5_5_SHAKE_SSK` (default), `SNOVA_24_5_4_ESK`, ... (see
`SnovaParameterSpec`). The SNOVA names keep their underscores and are not
accepted in dashed form
| `KYBER` | `ML-KEM-512`, `ML-KEM-768` (lifecycle manager default),
`ML-KEM-1024` (component default); `kyber512`, `kyber768` and `kyber1024` are
accepted as aliases
| `NTRU` | `ntruhps2048509`, ... (see `NTRUParameterSpec`)
| `NTRULPRime` | `ntrulpr653`, ... (see `NTRULPRimeParameterSpec`)
@@ -109,9 +111,9 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an
alias of the canonical na
The `parameterSpec` option is also honoured by the `generateKeyPair` lifecycle
operation, which then generates the key
at the configured security level.
-NOTE: `parameterSpec` is not supported for the stateful hash-based signature
algorithms (XMSS, XMSSMT, LMS, HSS), for
-MAYO and SNOVA, nor for the hybrid operations: those either have no
name-addressable BouncyCastle parameter set, or pair
-a fixed classical key set with a matching PQC key set. For those, register a
`KeyPair` bean in the registry instead.
+NOTE: `parameterSpec` is not supported for the stateful hash-based signature
algorithms (XMSS, XMSSMT, LMS, HSS) nor
+for the hybrid operations: those either have no name-addressable BouncyCastle
parameter set, or pair a fixed classical
+key set with a matching PQC key set. For those, register a `KeyPair` bean in
the registry instead.
== Supported Operations
diff --git
a/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
b/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
index 6a74385545ed..40d2efc491c6 100644
---
a/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
+++
b/components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/pqc.json
@@ -45,7 +45,7 @@
"keyRotationSchedulerEnabled": { "index": 18, "kind": "property",
"displayName": "Key Rotation Scheduler Enabled", "group": "advanced", "label":
"advanced", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue":
false, "description": "Whether to start an automated background key rotation
scheduler for this component. Requires keyLifecycleManager to be set. The
scheduler periodically rotates keys that exce [...]
"keyStore": { "index": 19, "kind": "property", "displayName": "Key Store",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.KeyStore", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "A KeyStore where we could get Cryptographic
material" },
"keyStorePassword": { "index": 20, "kind": "property", "displayName": "Key
Store Password", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The KeyStore password to use in combination
with KeySto [...]
- "parameterSpec": { "index": 21, "kind": "property", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
+ "parameterSpec": { "index": 21, "kind": "property", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
"signatureAlgorithm": { "index": 22, "kind": "property", "displayName":
"Signature Algorithm", "group": "advanced", "label": "advanced", "required":
false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLDSA",
"SLHDSA", "LMS", "HSS", "XMSS", "XMSSMT", "DILITHIUM", "FALCON", "SNOVA",
"MAYO", "SPHINCSPLUS" ], "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurati [...]
"signer": { "index": 23, "kind": "property", "displayName": "Signer",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.Signature", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The Signer to be used" },
"statefulKeyWarningThreshold": { "index": 24, "kind": "property",
"displayName": "Stateful Key Warning Threshold", "group": "advanced", "label":
"advanced", "required": false, "type": "number", "javaType": "double",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "defaultValue": 0.1, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The warning threshold for stateful key exh
[...]
@@ -98,7 +98,7 @@
"keyPairAlias": { "index": 13, "kind": "parameter", "displayName": "Key
Pair Alias", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "A KeyPair alias to use
in combination with KeyStore parameter" },
"keyStore": { "index": 14, "kind": "parameter", "displayName": "Key
Store", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "java.security.KeyStore", "deprecated": false,
"deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "A KeyStore where we
could get Cryptographic material" },
"keyStorePassword": { "index": 15, "kind": "parameter", "displayName":
"Key Store Password", "group": "advanced", "label": "advanced", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The KeyStore password to use in combination
with KeySt [...]
- "parameterSpec": { "index": 16, "kind": "parameter", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
+ "parameterSpec": { "index": 16, "kind": "parameter", "displayName":
"Parameter Spec", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.pqc.PQCConfiguration",
"configurationField": "configuration", "description": "The NIST parameter set
(security level) to use for the configured signature or key [...]
"signatureAlgorithm": { "index": 17, "kind": "parameter", "displayName":
"Signature Algorithm", "group": "advanced", "label": "advanced", "required":
false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLDSA",
"SLHDSA", "LMS", "HSS", "XMSS", "XMSSMT", "DILITHIUM", "FALCON", "SNOVA",
"MAYO", "SPHINCSPLUS" ], "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurat [...]
"signer": { "index": 18, "kind": "parameter", "displayName": "Signer",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType": "java.security.Signature", "deprecated": false, "deprecationNote":
"", "autowired": true, "secret": false, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The Signer to be used" },
"statefulKeyWarningThreshold": { "index": 19, "kind": "parameter",
"displayName": "Stateful Key Warning Threshold", "group": "advanced", "label":
"advanced", "required": false, "type": "number", "javaType": "double",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "defaultValue": 0.1, "configurationClass":
"org.apache.camel.component.pqc.PQCConfiguration", "configurationField":
"configuration", "description": "The warning threshold for stateful key ex [...]
diff --git a/components/camel-pqc/src/main/docs/pqc-component.adoc
b/components/camel-pqc/src/main/docs/pqc-component.adoc
index 136728d35fc4..91840a7ae7b4 100644
--- a/components/camel-pqc/src/main/docs/pqc-component.adoc
+++ b/components/camel-pqc/src/main/docs/pqc-component.adoc
@@ -95,6 +95,8 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an alias
of the canonical na
| `FALCON` | `FALCON-512`, `FALCON-1024`
| `DILITHIUM` | `ML-DSA-44` (lifecycle manager default), `ML-DSA-65`,
`ML-DSA-87` (component default)
| `SPHINCSPLUS` | The `SLHDSA` parameter sets, for example `SLH-DSA-SHA2-128S`
(default)
+| `MAYO` | `mayo1`, `mayo2`, `mayo3`, `mayo5` (default); the canonical dashed
form (`MAYO-1`) is accepted too
+| `SNOVA` | `SNOVA_24_5_5_SHAKE_SSK` (default), `SNOVA_24_5_4_ESK`, ... (see
`SnovaParameterSpec`). The SNOVA names keep their underscores and are not
accepted in dashed form
| `KYBER` | `ML-KEM-512`, `ML-KEM-768` (lifecycle manager default),
`ML-KEM-1024` (component default); `kyber512`, `kyber768` and `kyber1024` are
accepted as aliases
| `NTRU` | `ntruhps2048509`, ... (see `NTRUParameterSpec`)
| `NTRULPRime` | `ntrulpr653`, ... (see `NTRULPRimeParameterSpec`)
@@ -109,9 +111,9 @@ BouncyCastle constants (`ml_dsa_87`) is accepted as an
alias of the canonical na
The `parameterSpec` option is also honoured by the `generateKeyPair` lifecycle
operation, which then generates the key
at the configured security level.
-NOTE: `parameterSpec` is not supported for the stateful hash-based signature
algorithms (XMSS, XMSSMT, LMS, HSS), for
-MAYO and SNOVA, nor for the hybrid operations: those either have no
name-addressable BouncyCastle parameter set, or pair
-a fixed classical key set with a matching PQC key set. For those, register a
`KeyPair` bean in the registry instead.
+NOTE: `parameterSpec` is not supported for the stateful hash-based signature
algorithms (XMSS, XMSSMT, LMS, HSS) nor
+for the hybrid operations: those either have no name-addressable BouncyCastle
parameter set, or pair a fixed classical
+key set with a matching PQC key set. For those, register a `KeyPair` bean in
the registry instead.
== Supported Operations
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConfiguration.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConfiguration.java
index a3e689e3a68f..d53b58dab0ac 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConfiguration.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCConfiguration.java
@@ -200,8 +200,8 @@ public class PQCConfiguration implements Cloneable {
* the BouncyCastle parameter-set names: for example ML-DSA-44, ML-DSA-65
or ML-DSA-87 for MLDSA, and ML-KEM-512,
* ML-KEM-768 or ML-KEM-1024 for MLKEM. Names are case-insensitive and the
underscore form (ml_dsa_87) is accepted
* as an alias. When set, the key material is generated with this
parameter set instead of the algorithm default.
- * Not supported for the stateful signature algorithms (XMSS, XMSSMT, LMS,
HSS), for MAYO and SNOVA, nor for the
- * hybrid operations: for those, register a KeyPair bean in the registry
instead.
+ * Not supported for the stateful signature algorithms (XMSS, XMSSMT, LMS,
HSS) nor for the hybrid operations: for
+ * those, register a KeyPair bean in the registry instead.
*/
public void setParameterSpec(String parameterSpec) {
this.parameterSpec = parameterSpec;
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCParameterSpecResolver.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCParameterSpecResolver.java
index 37e5f3be2761..b8eb14151fcf 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCParameterSpecResolver.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCParameterSpecResolver.java
@@ -28,10 +28,12 @@ import org.bouncycastle.jcajce.spec.SLHDSAParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.BIKEParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.FalconParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.HQCParameterSpec;
+import org.bouncycastle.pqc.jcajce.spec.MayoParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.NTRULPRimeParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.NTRUParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.SABERParameterSpec;
import org.bouncycastle.pqc.jcajce.spec.SNTRUPrimeParameterSpec;
+import org.bouncycastle.pqc.jcajce.spec.SnovaParameterSpec;
/**
* Resolves the BouncyCastle {@link AlgorithmParameterSpec} for a PQC
algorithm from the parameter-set name configured
@@ -41,8 +43,8 @@ import
org.bouncycastle.pqc.jcajce.spec.SNTRUPrimeParameterSpec;
* is accepted as an alias of the canonical dashed name ({@code ML-DSA-87}).
* <p/>
* The parameter set determines the NIST security level of the generated key
material. The stateful hash-based signature
- * algorithms (XMSS, XMSSMT, LMS, HSS) and MAYO/SNOVA have no name-addressable
BouncyCastle parameter spec and are
- * therefore not supported here - for those, register a
KeyPair/Signature/KeyGenerator bean in the registry instead.
+ * algorithms (XMSS, XMSSMT, LMS, HSS) have no name-addressable BouncyCastle
parameter spec and are therefore not
+ * supported here - for those, register a KeyPair/Signature/KeyGenerator bean
in the registry instead.
*/
public final class PQCParameterSpecResolver {
@@ -51,7 +53,7 @@ public final class PQCParameterSpecResolver {
*/
private static final Set<String> SUPPORTED_ALGORITHMS = Set.of(
// Signature algorithms
- "MLDSA", "SLHDSA", "FALCON", "DILITHIUM", "SPHINCSPLUS",
+ "MLDSA", "SLHDSA", "FALCON", "DILITHIUM", "SPHINCSPLUS", "MAYO",
"SNOVA",
// Key encapsulation algorithms
"MLKEM", "KYBER", "NTRU", "NTRULPRime", "SNTRUPrime", "BIKE",
"HQC", "CMCE", "FRODO", "SABER");
@@ -81,30 +83,41 @@ public final class PQCParameterSpecResolver {
throw new IllegalArgumentException(
"The parameterSpec option is not supported for algorithm "
+ algorithm
+ ". Supported algorithms are:
" + SUPPORTED_ALGORITHMS
- + ". For the stateful signature
algorithms (XMSS, XMSSMT, LMS, HSS) and"
- + " for MAYO/SNOVA, register a
KeyPair bean in the registry instead.");
+ + ". For the stateful signature
algorithms (XMSS, XMSSMT, LMS, HSS),"
+ + " register a KeyPair bean in
the registry instead.");
}
- // BouncyCastle resolves parameter-set names case-insensitively but
never uses underscores in them, so accept
- // the underscore form (ml_dsa_87), which matches the BouncyCastle
constant names, as an alias.
- String name = parameterSpec.replace('_', '-');
+ // The name is tried as written first. Most BouncyCastle specs spell
their parameter sets with dashes and
+ // resolve the underscore form only through the alias below, but the
SNOVA names keep their underscores
+ // (SNOVA_24_5_5_SHAKE_SSK) and do not resolve in dashed form at all,
so rewriting first would make every
+ // SNOVA parameter set unreachable.
+ AlgorithmParameterSpec resolved = tryResolve(algorithm, parameterSpec);
- AlgorithmParameterSpec resolved;
- try {
- resolved = doResolve(algorithm, name);
- } catch (IllegalArgumentException e) {
- // The ML-DSA/ML-KEM/SLH-DSA/CMCE/FrodoKEM specs throw for an
unknown name
- throw new IllegalArgumentException(
- "Unknown parameterSpec '" + parameterSpec + "' for
algorithm " + algorithm, e);
+ if (resolved == null && parameterSpec.indexOf('_') >= 0) {
+ // Accept the underscore form of a dashed name (ml_dsa_87 for
ML-DSA-87), which matches how the
+ // BouncyCastle constants are written
+ resolved = tryResolve(algorithm, parameterSpec.replace('_', '-'));
}
+
if (resolved == null) {
- // The older BouncyCastle specs return null instead of throwing
for an unknown name
throw new IllegalArgumentException(
"Unknown parameterSpec '" + parameterSpec + "' for
algorithm " + algorithm);
}
return resolved;
}
+ /**
+ * Resolves one spelling of a parameter-set name, answering {@code null}
when it is not known. Some BouncyCastle
+ * specs throw for an unknown name and others return {@code null}, so both
are normalised here.
+ */
+ private static AlgorithmParameterSpec tryResolve(String algorithm, String
parameterSpec) {
+ try {
+ return doResolve(algorithm, parameterSpec);
+ } catch (IllegalArgumentException e) {
+ return null;
+ }
+ }
+
private static AlgorithmParameterSpec doResolve(String algorithm, String
parameterSpec) {
switch (algorithm) {
// Signature algorithms
@@ -120,6 +133,10 @@ public final class PQCParameterSpecResolver {
return MLDSAParameterSpec.fromName(parameterSpec);
case "SPHINCSPLUS":
return SLHDSAParameterSpec.fromName(parameterSpec);
+ case "MAYO":
+ return MayoParameterSpec.fromName(parameterSpec);
+ case "SNOVA":
+ return SnovaParameterSpec.fromName(parameterSpec);
// Key encapsulation algorithms
case "MLKEM":
case "KYBER":
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
index ecadab55d4b7..10b2af9702e2 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/PQCProducer.java
@@ -93,14 +93,16 @@ public class PQCProducer extends DefaultProducer {
// Signature algorithms not part of NIST FIPS 204/205 post-quantum
standards.
// XMSS/XMSSMT are NIST SP 800-208 but are stateful and not in FIPS
204/205.
- private static final Set<String> NON_FIPS_PQ_SIGNATURES = Set.of(
+ // DILITHIUM and SPHINCSPLUS are deliberately absent: they are aliases
that resolve to ML-DSA and SLH-DSA
+ // respectively (see PQCSignatureAlgorithms), so warning that they are
"not FIPS 204/205" and recommending
+ // ML-DSA / SLH-DSA instead would tell the user to switch to what they are
already using.
+ // Package-private so the unit test can assert on the set itself rather
than on the source text
+ static final Set<String> NON_FIPS_PQ_SIGNATURES = Set.of(
PQCSignatureAlgorithms.XMSS.name(),
PQCSignatureAlgorithms.XMSSMT.name(),
- PQCSignatureAlgorithms.DILITHIUM.name(),
PQCSignatureAlgorithms.FALCON.name(),
PQCSignatureAlgorithms.SNOVA.name(),
- PQCSignatureAlgorithms.MAYO.name(),
- PQCSignatureAlgorithms.SPHINCSPLUS.name());
+ PQCSignatureAlgorithms.MAYO.name());
// KEM algorithms not part of NIST FIPS 203 post-quantum standard.
private static final Set<String> NON_FIPS_PQ_KEMS = Set.of(
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultFalconMaterial.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultFalconMaterial.java
index 8cec27835e86..f5a6a00b88ce 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultFalconMaterial.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultFalconMaterial.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.pqc.crypto;
import java.security.*;
import org.apache.camel.component.pqc.PQCSignatureAlgorithms;
+import org.apache.camel.util.SecureRandomHelper;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pqc.jcajce.provider.BouncyCastlePQCProvider;
import org.bouncycastle.pqc.jcajce.spec.FalconParameterSpec;
@@ -49,7 +50,7 @@ public class PQCDefaultFalconMaterial {
throws NoSuchAlgorithmException, NoSuchProviderException,
InvalidAlgorithmParameterException {
KeyPairGenerator kpGen =
KeyPairGenerator.getInstance(PQCSignatureAlgorithms.FALCON.getAlgorithm(),
PQCSignatureAlgorithms.FALCON.getBcProvider());
- kpGen.initialize(FalconParameterSpec.falcon_1024);
+ kpGen.initialize(FalconParameterSpec.falcon_1024,
SecureRandomHelper.getSecureRandom());
return kpGen;
}
}
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultHSSMaterial.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultHSSMaterial.java
index 8efbcd30ff20..1a1fcd645984 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultHSSMaterial.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultHSSMaterial.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.pqc.crypto;
import java.security.*;
import org.apache.camel.component.pqc.PQCSignatureAlgorithms;
+import org.apache.camel.util.SecureRandomHelper;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pqc.crypto.lms.LMOtsParameters;
import org.bouncycastle.pqc.crypto.lms.LMSigParameters;
@@ -56,7 +57,7 @@ public class PQCDefaultHSSMaterial {
new LMSKeyGenParameterSpec(LMSigParameters.lms_sha256_n32_h5,
LMOtsParameters.sha256_n32_w2),
new LMSKeyGenParameterSpec(LMSigParameters.lms_sha256_n32_h5,
LMOtsParameters.sha256_n32_w2)
};
- kpGen.initialize(new LMSHSSKeyGenParameterSpec(lmsSpecs));
+ kpGen.initialize(new LMSHSSKeyGenParameterSpec(lmsSpecs),
SecureRandomHelper.getSecureRandom());
return kpGen;
}
}
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultLMSMaterial.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultLMSMaterial.java
index 70e74e67326d..1ea30ca3150c 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultLMSMaterial.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultLMSMaterial.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.pqc.crypto;
import java.security.*;
import org.apache.camel.component.pqc.PQCSignatureAlgorithms;
+import org.apache.camel.util.SecureRandomHelper;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pqc.crypto.lms.LMOtsParameters;
import org.bouncycastle.pqc.crypto.lms.LMSigParameters;
@@ -51,7 +52,8 @@ public class PQCDefaultLMSMaterial {
throws NoSuchAlgorithmException, NoSuchProviderException,
InvalidAlgorithmParameterException {
KeyPairGenerator kpGen =
KeyPairGenerator.getInstance(PQCSignatureAlgorithms.LMS.getAlgorithm(),
PQCSignatureAlgorithms.LMS.getBcProvider());
- kpGen.initialize(new
LMSKeyGenParameterSpec(LMSigParameters.lms_sha256_n32_h5,
LMOtsParameters.sha256_n32_w1));
+ kpGen.initialize(new
LMSKeyGenParameterSpec(LMSigParameters.lms_sha256_n32_h5,
LMOtsParameters.sha256_n32_w1),
+ SecureRandomHelper.getSecureRandom());
return kpGen;
}
}
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultMAYOMaterial.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultMAYOMaterial.java
index 0948b9eed9bc..cd373de34173 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultMAYOMaterial.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultMAYOMaterial.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.pqc.crypto;
import java.security.*;
import org.apache.camel.component.pqc.PQCSignatureAlgorithms;
+import org.apache.camel.util.SecureRandomHelper;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pqc.jcajce.provider.BouncyCastlePQCProvider;
import org.bouncycastle.pqc.jcajce.spec.MayoParameterSpec;
@@ -49,7 +50,7 @@ public class PQCDefaultMAYOMaterial {
throws NoSuchAlgorithmException, NoSuchProviderException,
InvalidAlgorithmParameterException {
KeyPairGenerator kpGen =
KeyPairGenerator.getInstance(PQCSignatureAlgorithms.MAYO.getAlgorithm(),
PQCSignatureAlgorithms.MAYO.getBcProvider());
- kpGen.initialize(MayoParameterSpec.mayo5);
+ kpGen.initialize(MayoParameterSpec.mayo5,
SecureRandomHelper.getSecureRandom());
return kpGen;
}
}
diff --git
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultSNOVAMaterial.java
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultSNOVAMaterial.java
index 2f3af59d894d..fe6a66db4a8e 100644
---
a/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultSNOVAMaterial.java
+++
b/components/camel-pqc/src/main/java/org/apache/camel/component/pqc/crypto/PQCDefaultSNOVAMaterial.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.pqc.crypto;
import java.security.*;
import org.apache.camel.component.pqc.PQCSignatureAlgorithms;
+import org.apache.camel.util.SecureRandomHelper;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pqc.jcajce.provider.BouncyCastlePQCProvider;
import org.bouncycastle.pqc.jcajce.spec.SnovaParameterSpec;
@@ -49,7 +50,7 @@ public class PQCDefaultSNOVAMaterial {
throws NoSuchAlgorithmException, NoSuchProviderException,
InvalidAlgorithmParameterException {
KeyPairGenerator kpGen =
KeyPairGenerator.getInstance(PQCSignatureAlgorithms.SNOVA.getAlgorithm(),
PQCSignatureAlgorithms.SNOVA.getBcProvider());
- kpGen.initialize(SnovaParameterSpec.SNOVA_24_5_5_SHAKE_SSK);
+ kpGen.initialize(SnovaParameterSpec.SNOVA_24_5_5_SHAKE_SSK,
SecureRandomHelper.getSecureRandom());
return kpGen;
}
}
diff --git
a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCMaterialConsistencyTest.java
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCMaterialConsistencyTest.java
new file mode 100644
index 000000000000..d41d9bbedee6
--- /dev/null
+++
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCMaterialConsistencyTest.java
@@ -0,0 +1,132 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.pqc;
+
+import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.spec.AlgorithmParameterSpec;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.bouncycastle.pqc.jcajce.spec.MayoParameterSpec;
+import org.bouncycastle.pqc.jcajce.spec.SnovaParameterSpec;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Guards the consistency rules the sibling key material classes are meant to
follow but drifted away from, so the next
+ * clone-and-tweak does not reintroduce the divergence.
+ */
+class PQCMaterialConsistencyTest {
+
+ private static Path materialSourceRoot() throws URISyntaxException {
+ // the tests run from the module directory, so the sources sit at a
fixed relative path
+ Path root =
Paths.get("src/main/java/org/apache/camel/component/pqc/crypto");
+ assertTrue(Files.isDirectory(root), "cannot locate the key material
sources at " + root.toAbsolutePath());
+ return root;
+ }
+
+ private static List<Path> materialSources() throws Exception {
+ List<Path> sources = new ArrayList<>();
+ try (Stream<Path> files = Files.walk(materialSourceRoot())) {
+ files.filter(p ->
p.getFileName().toString().startsWith("PQCDefault"))
+ .filter(p ->
p.getFileName().toString().endsWith("Material.java"))
+ .forEach(sources::add);
+ }
+ assertFalse(sources.isEmpty(), "no key material sources found");
+ return sources;
+ }
+
+ @Test
+ void everyKeyMaterialSeedsItsGeneratorWithSecureRandomHelper() throws
Exception {
+ List<String> offenders = new ArrayList<>();
+ for (Path source : materialSources()) {
+ String text = Files.readString(source, StandardCharsets.UTF_8);
+ if (!text.contains("SecureRandomHelper.getSecureRandom()")) {
+ offenders.add(source.getFileName().toString());
+ }
+ }
+
+ assertTrue(offenders.isEmpty(),
+ "these key material classes fall back to the provider default
RNG instead of the shared"
+ + " SecureRandomHelper: " + offenders);
+ }
+
+ @ParameterizedTest
+ @ValueSource(strings = { "MAYO", "SNOVA" })
+ void mayoAndSnovaAcceptANamedParameterSet(String algorithm) {
+ assertTrue(PQCParameterSpecResolver.isSupported(algorithm),
+ algorithm + " has a name-addressable BouncyCastle parameter
spec and must accept parameterSpec");
+ }
+
+ /**
+ * {@code MayoParameterSpec.fromName} returns {@code null} for an unknown
name rather than throwing, and
+ * {@code getName()} answers the canonical form ({@code MAYO-1}) rather
than echoing the requested one, so the level
+ * actually resolved is pinned explicitly.
+ */
+ @ParameterizedTest
+ @CsvSource({
+ "MAYO,mayo1,MAYO-1",
+ "MAYO,mayo2,MAYO-2",
+ "MAYO,mayo3,MAYO-3",
+ "MAYO,mayo5,MAYO-5",
+ "MAYO,MAYO-1,MAYO-1",
+ // BouncyCastle keeps the underscores in the SNOVA names, so these
must survive as written
+ "SNOVA,SNOVA_24_5_5_SHAKE_SSK,SNOVA_24_5_5_SHAKE_SSK",
+ "SNOVA,snova_24_5_5_shake_ssk,SNOVA_24_5_5_SHAKE_SSK",
+ "SNOVA,SNOVA_24_5_4_ESK,SNOVA_24_5_4_ESK" })
+ void everyNamedLevelResolvesToTheLevelRequested(String algorithm, String
requested, String canonical) {
+ AlgorithmParameterSpec spec =
PQCParameterSpecResolver.resolve(algorithm, requested);
+
+ assertNotNull(spec, algorithm + " must resolve " + requested);
+ String name = spec instanceof MayoParameterSpec mayo
+ ? mayo.getName()
+ : ((SnovaParameterSpec) spec).getName();
+ assertEquals(canonical, name, "the resolved parameter set must be the
level that was requested");
+ }
+
+ @Test
+ void statefulAlgorithmsStillRejectAParameterSet() {
+ for (String algorithm : new String[] { "XMSS", "XMSSMT", "LMS", "HSS"
}) {
+ assertFalse(PQCParameterSpecResolver.isSupported(algorithm),
+ algorithm + " has no name-addressable parameter spec in
BouncyCastle");
+ }
+ }
+
+ @Test
+ void theAliasAlgorithmsAreNotReportedAsNonFips() {
+ // DILITHIUM resolves to ML-DSA and SPHINCSPLUS to SLH-DSA, so warning
that they are not FIPS 204/205 and
+ // recommending ML-DSA / SLH-DSA would point the user at what they
already use
+
assertFalse(PQCProducer.NON_FIPS_PQ_SIGNATURES.contains(PQCSignatureAlgorithms.DILITHIUM.name()),
+ "DILITHIUM is an ML-DSA alias and is FIPS 204");
+
assertFalse(PQCProducer.NON_FIPS_PQ_SIGNATURES.contains(PQCSignatureAlgorithms.SPHINCSPLUS.name()),
+ "SPHINCSPLUS is an SLH-DSA alias and is FIPS 205");
+
assertTrue(PQCProducer.NON_FIPS_PQ_SIGNATURES.contains(PQCSignatureAlgorithms.FALCON.name()),
+ "FALCON is genuinely not in FIPS 204/205 yet");
+ }
+}
diff --git
a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
index 86b4005e5e07..220ac83ecb8c 100644
---
a/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
+++
b/components/camel-pqc/src/test/java/org/apache/camel/component/pqc/PQCParameterSpecResolverTest.java
@@ -107,13 +107,14 @@ class PQCParameterSpecResolverTest {
void testIsSupported() {
assertTrue(PQCParameterSpecResolver.isSupported("MLDSA"));
assertTrue(PQCParameterSpecResolver.isSupported("MLKEM"));
- // Stateful hash-based signatures and MAYO/SNOVA have no
name-addressable parameter spec
+ // MAYO and SNOVA are stateless and
MayoParameterSpec/SnovaParameterSpec both expose fromName in BC 1.86
+ assertTrue(PQCParameterSpecResolver.isSupported("MAYO"));
+ assertTrue(PQCParameterSpecResolver.isSupported("SNOVA"));
+ // Stateful hash-based signatures have no name-addressable parameter
spec
assertFalse(PQCParameterSpecResolver.isSupported("XMSS"));
assertFalse(PQCParameterSpecResolver.isSupported("XMSSMT"));
assertFalse(PQCParameterSpecResolver.isSupported("LMS"));
assertFalse(PQCParameterSpecResolver.isSupported("HSS"));
- assertFalse(PQCParameterSpecResolver.isSupported("MAYO"));
- assertFalse(PQCParameterSpecResolver.isSupported("SNOVA"));
assertFalse(PQCParameterSpecResolver.isSupported(null));
}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index 9e7a7d47dc0a..fe0ffa58e525 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -373,6 +373,21 @@ Errors, warnings and tips are printed on stderr instead of
stdout, so stdout onl
as JSON. If a script reads the error text of a command from stdout, read
stderr instead. The list of plugins that are
not installed, after `camel --help`, is printed on stderr, and only in an
interactive terminal.
+=== camel-pqc - parameterSpec accepts MAYO and SNOVA, and the FIPS advisory no
longer flags two aliases
+
+`parameterSpec` can now select a named parameter set for `MAYO` and `SNOVA`.
Both were rejected on the grounds that
+they have no name-addressable BouncyCastle parameter spec, which is not the
case: `MayoParameterSpec.fromName` and
+`SnovaParameterSpec.fromName` both exist, and neither algorithm is stateful.
The stateful hash-based signatures
+(`XMSS`, `XMSSMT`, `LMS`, `HSS`) are still rejected, as they genuinely have no
such spec.
+
+`DILITHIUM` and `SPHINCSPLUS` no longer produce the "not part of NIST FIPS
204/205" warning on hybrid endpoints.
+Both are aliases that resolve to `ML-DSA` and `SLH-DSA`, so the warning was
recommending the algorithm already in
+use. `FALCON`, `MAYO`, `SNOVA`, `XMSS` and `XMSSMT` still warn.
+
+The five default key material classes that generated their key pair with the
provider's default RNG (`Falcon`,
+`MAYO`, `SNOVA`, `LMS`, `HSS`) now use the shared `SecureRandomHelper` like
the other sixteen. No key format or
+parameter set changes; only the randomness source is now uniform.
+
=== camel-cli-connector - every action with a request id gets an answer
An action written to `~/.camel/<pid>-action-<requestId>.json` now always gets
an answer in
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/PqcComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/PqcComponentBuilderFactory.java
index 869bd26fa51c..467f1fad9656 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/PqcComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/PqcComponentBuilderFactory.java
@@ -415,9 +415,9 @@ public interface PqcComponentBuilderFactory {
* are case-insensitive and the underscore form (ml_dsa_87) is accepted
* as an alias. When set, the key material is generated with this
* parameter set instead of the algorithm default. Not supported for
the
- * stateful signature algorithms (XMSS, XMSSMT, LMS, HSS), for MAYO and
- * SNOVA, nor for the hybrid operations: for those, register a KeyPair
- * bean in the registry instead.
+ * stateful signature algorithms (XMSS, XMSSMT, LMS, HSS) nor for the
+ * hybrid operations: for those, register a KeyPair bean in the
registry
+ * instead.
*
* The option is a: <code>java.lang.String</code> type.
*
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
index 547230ed89fc..ecb5438519a1 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/PQCEndpointBuilderFactory.java
@@ -440,9 +440,9 @@ public interface PQCEndpointBuilderFactory {
* are case-insensitive and the underscore form (ml_dsa_87) is accepted
* as an alias. When set, the key material is generated with this
* parameter set instead of the algorithm default. Not supported for
the
- * stateful signature algorithms (XMSS, XMSSMT, LMS, HSS), for MAYO and
- * SNOVA, nor for the hybrid operations: for those, register a KeyPair
- * bean in the registry instead.
+ * stateful signature algorithms (XMSS, XMSSMT, LMS, HSS) nor for the
+ * hybrid operations: for those, register a KeyPair bean in the
registry
+ * instead.
*
* The option is a: <code>java.lang.String</code> type.
*
