On Wed, 4 Nov 2026 19:45:33 GMT, Hai-May Chao <[email protected]> wrote:
>> src/java.base/share/classes/sun/security/ssl/NamedGroup.java line 306:
>>
>>> 304: if (namedGroupSpec == NamedGroupSpec.NAMED_GROUP_KEM) {
>>> 305: KeyPairGenerator.getInstance(name);
>>> 306: KEM.getInstance(name);
>>
>> Instead of instantiating `KeyPairGenerator` and `KEM` and catching
>> exceptions, can we instead skip these if the name is a hybrid alg?
>
> I think we can not skip the `KeyPairGenerator` and KEM probes as
> `NamedGroup.isAvailable()` decides whether a group is enabled, advertised,
> and selected during TLS 1.3 keyshare negotiation. Without those checks, a
> hybrid group could be advertised even when no provider can create its key
> pair or perform its KEM operation.
I considered whether we could simply call `GetInstance.getService()`, since
instantiating a hybrid `KeyPairGenerator` or `KEM` is quite expensive, as it
also instantiates the sub KPGs or KEMs. However, without instantiating them, I
don't know if there is a reliable way to find out whether the components are
available. If we introduce features that disable or filter algorithms in the
future, it will likely become even more difficult to confirm it.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/33433#discussion_r4480729954
