Andrea Cosentino created CAMEL-25794:
----------------------------------------
Summary: camel-pqc - HSS, XMSSMT and SNTRUPrime get no default key
material and fail at the first exchange
Key: CAMEL-25794
URL: https://issues.apache.org/jira/browse/CAMEL-25794
Project: Camel
Issue Type: Bug
Components: camel-pqc
Reporter: Andrea Cosentino
{{PQCComponent}} autowires a default {{KeyPair}}/{{Signature}}/{{KeyGenerator}}
for most algorithms, but three advertised constants are missing from the
switches and fall through {{default: break;}}.
h3. Signature switch — {{PQCComponent.java:100-139}}
Covers MLDSA, SLHDSA, LMS, XMSS, FALCON, SNOVA, MAYO, DILITHIUM, SPHINCSPLUS.
Missing: *HSS* and *XMSSMT*, although both are declared in
{{PQCSignatureAlgorithms}}:
{code:java}
HSS("LMS", "BC"),
XMSSMT("XMSSMT", "BCPQC"),
{code}
h3. KEM switch — {{PQCComponent.java:146-185}}
Missing: *SNTRUPrime*, although {{PQCKeyEncapsulationAlgorithms}} declares it.
h3. Consequence
{{PQCDefaultHSSMaterial}}, {{PQCDefaultXMSSMTMaterial}} and
{{PQCDefaultSNTRUPrimeMaterial}} all exist but have *zero references* anywhere
in {{src/main/java}} or {{src/test/java}} — they are dead code.
A route such as {{pqc:x?operation=sign&signatureAlgorithm=XMSSMT}} with no
registry bean passes {{doStart()}} (the {{Signature}} is built) and then fails
per-exchange with a {{NullPointerException}} at {{PQCProducer.java:530}}:
{code:java}
signerForExchange.initSign(keyPair.getPrivate());
{code}
h3. The documentation promises the opposite
{{src/main/docs/pqc-component.adoc:359}} and {{:366}} list
{{PQCDefaultXMSSMTMaterial}} and {{PQCDefaultHSSMaterial}} in the "Other
Signature Algorithms" table, and {{:421}} lists {{SNTRUPrime}} under supported
KEMs with the usual "In case the KeyPair and the KeyGenerator Objects are not
in the registry, it will provide two instances ... with default implementation."
h3. Also in this file: a wrong JCA name in the docs
{{pqc-component.adoc:363}} gives the JCA algorithm name for HSS as {{HSS}}.
Bouncy Castle 1.86 registers only {{KeyPairGenerator.LMS}} / {{Signature.LMS}}
/ {{KeyFactory.LMS}} — there is no {{HSS}} service. The enum is correct
({{HSS("LMS", "BC")}}); the table is not.
h3. Suggested fix
Add the three missing {{case}} arms, and make the switch fall-through fail fast
at endpoint creation rather than deferring to a per-exchange NPE.
h3. Test gap
Every other algorithm has a {{*NoAutowiredTest}} companion that exercises the
URI-only path. There is none for HSS, XMSSMT or SNTRUPrime —
{{PQCSignatureHSSTest}} and {{PQCSignatureXMSSMTTest}} bind their own registry
beans, which is why CI does not see this.
----
_Reported by Claude Code (AI agent) on behalf of [~oscerd]. Every code
reference was verified against commit {{7aae27315946}} on {{main}}._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
