[
https://issues.apache.org/jira/browse/CAMEL-25794?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-25794:
--------------------------------
Fix Version/s: 4.24.0
> camel-pqc - HSS, XMSSMT and SNTRUPrime get no default key material and fail
> at the first exchange
> -------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25794
> URL: https://issues.apache.org/jira/browse/CAMEL-25794
> Project: Camel
> Issue Type: Bug
> Components: camel-pqc
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> {{PQCComponent}} autowires a default
> {{KeyPair}}/{{Signature}}/{{KeyGenerator}} for most algorithms, but three
> advertised constants are missing from the switches and fall through
> {{default: break;}}.
> h3. Signature switch — {{PQCComponent.java:100-139}}
> Covers MLDSA, SLHDSA, LMS, XMSS, FALCON, SNOVA, MAYO, DILITHIUM, SPHINCSPLUS.
> Missing: *HSS* and *XMSSMT*, although both are declared in
> {{PQCSignatureAlgorithms}}:
> {code:java}
> HSS("LMS", "BC"),
> XMSSMT("XMSSMT", "BCPQC"),
> {code}
> h3. KEM switch — {{PQCComponent.java:146-185}}
> Missing: *SNTRUPrime*, although {{PQCKeyEncapsulationAlgorithms}} declares it.
> h3. Consequence
> {{PQCDefaultHSSMaterial}}, {{PQCDefaultXMSSMTMaterial}} and
> {{PQCDefaultSNTRUPrimeMaterial}} all exist but have *zero references*
> anywhere in {{src/main/java}} or {{src/test/java}} — they are dead code.
> A route such as {{pqc:x?operation=sign&signatureAlgorithm=XMSSMT}} with no
> registry bean passes {{doStart()}} (the {{Signature}} is built) and then
> fails per-exchange with a {{NullPointerException}} at
> {{PQCProducer.java:530}}:
> {code:java}
> signerForExchange.initSign(keyPair.getPrivate());
> {code}
> h3. The documentation promises the opposite
> {{src/main/docs/pqc-component.adoc:359}} and {{:366}} list
> {{PQCDefaultXMSSMTMaterial}} and {{PQCDefaultHSSMaterial}} in the "Other
> Signature Algorithms" table, and {{:421}} lists {{SNTRUPrime}} under
> supported KEMs with the usual "In case the KeyPair and the KeyGenerator
> Objects are not in the registry, it will provide two instances ... with
> default implementation."
> h3. Also in this file: a wrong JCA name in the docs
> {{pqc-component.adoc:363}} gives the JCA algorithm name for HSS as {{HSS}}.
> Bouncy Castle 1.86 registers only {{KeyPairGenerator.LMS}} /
> {{Signature.LMS}} / {{KeyFactory.LMS}} — there is no {{HSS}} service. The
> enum is correct ({{HSS("LMS", "BC")}}); the table is not.
> h3. Suggested fix
> Add the three missing {{case}} arms, and make the switch fall-through fail
> fast at endpoint creation rather than deferring to a per-exchange NPE.
> h3. Test gap
> Every other algorithm has a {{*NoAutowiredTest}} companion that exercises the
> URI-only path. There is none for HSS, XMSSMT or SNTRUPrime —
> {{PQCSignatureHSSTest}} and {{PQCSignatureXMSSMTTest}} bind their own
> registry beans, which is why CI does not see this.
> ----
> _Reported by Claude Code (AI agent) on behalf of [~oscerd]. Every code
> reference was verified against commit {{7aae27315946}} on {{main}}._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
