Add initial support for OpenPGP message decryption with Smart Cards (YubiKey + Simulator) - #2374
Open
vanitasvitae wants to merge 4248 commits into
Open
Add initial support for OpenPGP message decryption with Smart Cards (YubiKey + Simulator)#2374vanitasvitae wants to merge 4248 commits into
vanitasvitae wants to merge 4248 commits into
Conversation
…rge of main: keep new base code on the Java 4 source floor, add jdk1.4 compile overlays, refresh ant excludes and make the affected tests 1.4-safe
…ioural fixes: name-constraint bypasses, RSA/ElGamal decrypt hardening, policy-tree and keystore iteration DoS guards, CRL signer recursion guard with AKI narrowing, CRL cache TTL, armor-header CRLF rejection, destroyable races, plus provider KDF/XChaCha registrations
X.509 name-parse robustness (COV-4 / COV-6) See merge request root/bc-java!254
…lay so the build1-4 build keeps compiling the updated PKIXNameConstraintValidator
…urce preprocessing limits, real-1.4-javac floor, overlay delete-vs-sync discipline and the build/sign/test flow
…, relates to github bcgit#2176. Private keys for all standard (RFC 8391 + SP 800-208) XMSS/XMSS^MT parameter sets now encode in the RFC 9802 id-alg-xmss-hashsig / id-alg-xmssmt-hashsig form the public key already uses - the 4-octet parameter-set OID is carried ahead of the raw key so the private and public halves of a keypair share one algorithm OID and a private key round-trips losslessly to its exact parameter set (including n). Previously private keys always used the legacy PQCObjectIdentifiers.xmss(_mt) + XMSSKeyParams form, which cannot represent the SP 800-208 sets: SHAKE256/256 and SHAKE256/192 threw on encode, and SHA-256/192 silently round-tripped to the n=32 set. The legacy form is still read. The SP 800-208 sets are now also reachable through the JCA: XMSSParameterSpec / XMSSMTParameterSpec gain SHA256_192 / SHAKE256_256 / SHAKE256_192 selectors and named constants, both KeyPairGenerator SPIs build them (via the now-public explicit-n XMSSParameters / XMSSMTParameters constructors), an unknown tree digest now throws InvalidAlgorithmParameterException instead of a later NPE, and getTreeDigest() is n-aware so the /192 and /256 variants sharing a tree-digest OID are distinguished. org.bouncycastle.asn1.iana.IANAObjectIdentifiers is consolidated into the core source tree (published in bcprov, exported by the org.bouncycastle.provider module) and the internal.asn1.iana copy is removed, so there is a single definition; iana is dropped from the bcutil bnd Export-Package and the util module-info. The public class name is unchanged.
…ytesFully() rather than allocating the full declared length up front, so a short crafted header over a raw stream cannot drive a heap-sized allocation before any data is read (CWE-789); DefiniteLengthInputStream.toByteArray() reads through the stream itself so the "DEF length ... object truncated by ..." truncation message is preserved.
… Key Usage constants (id_kp_documentSigning RFC 9336, id_kp_imUri RFC 9734, and the four RFC 9809 constants), guarding their id-kp branch numbers against typos.
…names out of private StreamUtil constants into public Properties.ASN1_MAX_CONS_DEPTH / Properties.ASN1_MAX_LIMIT (values unchanged), mirrored into the jdk1.4 Properties overlay and referenced from StreamLimitTest.
… the verify contract)
CMS: type-check asn1.cms.Attribute decode (no ClassCastException past the verify contract) See merge request root/bc-java!257
…er family with InvalidKeyException, keeping the generic and pre-hash signers key-driven, relates to github bcgit#2176.
…module descriptors and add its package-info
…con entries, fixed section numbering and unescaped angle-bracket literals, completed the GOST3410ParametersGenerator entry and reworded the ML-DSA and HQC entries
… and BCPQC providers as announced in the 1.84 release notes, the low-level implementations remain available
…info converter test sweeping all 36 MQOM parameter sets, added AIMerParameterSpec to the fromName round-trip sweep
…ine classes, the public API surface is the key pair generator and signer
… moved the FAEST Owf cross-check helper into the test tree where its only caller lives
…s, a leftover of the expired draft-zauner-tls-aes-ocb, together with its module exports
…QC packages and added the missing package-info files for the aimer, qruov, sdith and xwing packages
…ferences to oid is provider code
…) and CVE-2024-29857 (F2m field size), cross-reference every 1.78 advisory CVE from its defects-fixed entry, and credit the Robusta team's constant-time analysis.
… their ASCII equivalents: U+2010 and U+2011 hyphens, an en dash, and smart quotes and apostrophes.
…ferenced between its defects-fixed entry and the security advisory block, with 1.78 as the worked example.
…f2m_field_size F2m field size bound (CVE-2024-29857) and use it in ECCurve rather than the inlined literal, mirroring the constant into the jdk1.4 overlay.
… sampler branch-free, so neither leaks secret-derived values through cache-line selection or control flow, and add an exhaustive GF regression test with the Ant provider-exclude and bctest-include wiring it needs; reported by the Robusta team.
…nd raise the count of acknowledged Robusta findings addressed to 38.
…erence implementation's fold-and-select and its MODQ mask so the secret operand is not exposed through division latency, with an exhaustive regression test and the Ant bctest include it needs; reported by the Robusta team.
…essController.doPrivileged, so the FilePermission for the JRE's jssecacerts/cacerts is required of the provider rather than of every protection domain on the call stack.
ligefeiBouncycastle
self-requested a review
July 31, 2026 03:57
hubot
pushed a commit
that referenced
this pull request
Aug 1, 2026
Collaborator
|
Hi @vanitasvitae, Before going further, would you mind resyncing the branch onto current main and continuing from there? The earlier state of this PR is already merged, with a review pass on top, so working from current main means you can see what we've changed, and your own commits won't be masked by the ~4000 commits of drift. It also makes anything you need from our side easy to pick up. Worth rebasing rather than merging: a few of the files you touched were adjusted in that review pass, so a rebase will surface those as conflicts you can resolve deliberately, where a merge would quietly take the older versions. One heads-up for when you do, there are some debug leftovers still on the branch: Thank you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is based on and includes #2339
Inhere, I modified BCs API to allow for message decryption with external secret keys.
On top of that, I introduced
AbstractPublicKeyDataDecryptorFactory.getCryptoCallback()and reworked theBcPublicKeyDataDecryptorFactoryto cleanly separate out PK crypto operations during session-key recovery, for sake of simple delegation to hardware devices in subclasses.Furthermode, the new module
pgscnow contains the initial design of a smart card API for bcpg. It currently supports listing cards, uploading key material and decrypting messages using both a simulated smart card backend, as well as an implementation using the YubiKit library.TODO:
JcaPublicKeyDataDecryptorFactoryJcaExternalPublicKeyDataDecryptorFactoryYubikeyPublicKeyDataDecryptorFactoryto implement both a BC and JCA version.