On Mon, 19 Oct 2026 07:53:51 GMT, Hai-May Chao <[email protected]> wrote:
> This feature enables SunJSSE to use a TLS 1.3 hybrid named group implemented > directly by a security provider as JCA `KeyPairGenerator` and `KEM` services. > It also moves the JDK implementations of `X25519MLKEM768`, SecP256r1MLKEM768, > and `SecP384r1MLKEM1024` into SunJCE provider. > > --------- > - [X] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/java.base/share/classes/sun/security/ssl/Hybrid.java line 102: > 100: } > 101: if (name.startsWith("ML-KEM")) { > 102: return KeyPairGenerator.getInstance(name, sunJCE()); Why must we instantiate from SunJCE? src/java.base/share/classes/sun/security/ssl/Hybrid.java line 462: > 460: this.k2 = k2; > 461: byte[] encoded1 = k1.getEncoded(); > 462: byte[] encoded2 = k2.getEncoded(); What if `k1` or `k2` is not extractable? Why is the old multiple round `addIKM` feature dropped? ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4313998033 PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4314020717
