On Mon, 19 Oct 2026 07:53:51 GMT, Hai-May Chao <[email protected]> wrote:
> This feature enables SunJSSE to use a TLS 1.3 hybrid named group implemented > directly by a security provider as JCA `KeyPairGenerator` and `KEM` services. > It also moves the JDK implementations of `X25519MLKEM768`, SecP256r1MLKEM768, > and `SecP384r1MLKEM1024` into SunJCE provider. > > --------- > - [X] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Some comments. src/java.base/share/classes/sun/security/ssl/KAKeyDerivation.java line 170: > 168: // A non-RAW secret from a KEM can be provider-opaque. It > 169: // must be consumed by a KDF supplied by the provider > that > 170: // created it. Now that there is no private provider, can we let delayed provider selection take care of KDF selection? ------------- PR Review: https://git.openjdk.org/jdk/pull/33433#pullrequestreview-5571889153 PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4314074280
