On Wed, 4 Nov 2026 12:51:23 GMT, Sean Mullan <[email protected]> wrote:
>> Hai-May Chao has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> Update with Weijun's comments
>
> src/java.base/share/classes/sun/security/ssl/NamedGroup.java line 306:
>
>> 304: if (namedGroupSpec == NamedGroupSpec.NAMED_GROUP_KEM) {
>> 305: KeyPairGenerator.getInstance(name);
>> 306: KEM.getInstance(name);
>
> Instead of instantiating `KeyPairGenerator` and `KEM` and catching
> exceptions, can we instead skip these if the name is a hybrid alg?
I think we can not skip the `KeyPairGenerator` and KEM probes as
`NamedGroup.isAvailable()` decides whether a group is enabled, advertised, and
selected during TLS 1.3 keyshare negotiation. Without those checks, a hybrid
group could be advertised even when no provider can create its key pair or
perform its KEM operation.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4472473748
