Croway commented on PR #29094: URL: https://github.com/apache/camel/pull/29094#issuecomment-6607143988
Two points, both reproduced with a Camel producer on the *runtime* classpath of a project that depends only on the component. Setup: this PR vs merge base 8bd7c2ed53b7, JDK 21, against an embedded sshd 2.20.0 + BC 1.86 server that prints the negotiated kex. **1. The "require post-quantum" examples fail against OpenSSH 8.9–9.8** (`mina-sftp-security.adoc`, `ssh-component.adoc`, `sftp-component.adoc`). Before 9.9, OpenSSH offers the hybrid only as `[email protected]` (`myproposal.h` at V_9_6_P1). That covers Ubuntu 22.04/24.04 and Debian 12. Against a server limited to OpenSSH 9.6's default kex list: - `mina-sftp:...&keyExchangeProtocols=mlkem768x25519-sha256,sntrup761x25519-sha512` → `SshException: Unable to negotiate key`. With `[email protected]` added, it negotiates `[email protected]`. - `ssh:...&kex=mlkem768x25519-sha256,sntrup761x25519-sha512` fails, reported as "Failed to authenticate". With the `@openssh.com` name added, it negotiates `[email protected]`. - `sftp:` by default negotiates `curve25519-sha256`, because jsch doesn't propose sntrup by default. So "a server too old to offer a hybrid group" doesn't hold for 9.0–9.8. With `keyExchangeProtocols=mlkem768x25519-sha256,[email protected],curve25519-sha256`, this PR negotiates `[email protected]`; main gets `curve25519-sha256`. Could the examples include `[email protected]`? **2. Upgrade guide: camel-mina-sftp now changes the JVM's security providers.** With bcprov on the classpath, sshd's Bouncy Castle registrar appends `BC` to `Security.getProviders()` and makes it sshd's default provider. On main, sshd used SunEC/SUN for KeyFactory, KeyPairGenerator, KeyAgreement, Signature and MessageDigest. With this PR it uses BC for all five; AES and HMAC stay on SunJCE. This deserves a line for deployments that care about the provider list (e.g. FIPS). sshd's switch for the registrar is `org.apache.sshd.security.provider.BC.enabled=false`. _Claude Code on behalf of Croway_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
