feat(javanet): support Conscrypt security provider and PQC hybrid negotiation#2167
feat(javanet): support Conscrypt security provider and PQC hybrid negotiation#2167lqiu96 wants to merge 1 commit into
Conversation
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
5 times, most recently
from
066bffb to
3497a47
Compare
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
from
3497a47 to
f4a7445
Compare
product-auto-label
Bot
added
size: l
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
3 times, most recently
from
ac577db to
1e3ca17
Compare
product-auto-label
Bot
added
size: m
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
2 times, most recently
from
f738eaf to
33defc8
Compare
product-auto-label
Bot
added
size: l
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
12 times, most recently
from
7da5101 to
e165b84
Compare
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
2 times, most recently
from
d150877 to
d90f643
Compare
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
from
d90f643 to
b4d0fb8
Compare
| if (securityProvider != null) { | ||
| return SSLContext.getInstance(TLS_ALGORITHM, securityProvider); | ||
| } | ||
| // 2. Default: Try Conscrypt (assumed to be available as part of SDK) |
There was a problem hiding this comment.
Can we always pass the Conscrypt provider in? So this library may not have to be dependent on Conscrypt?
There was a problem hiding this comment.
I think that is an option. Right now that's the intention of provided scope, library isn't dependent on Conscrypt and will only enable it by default if it's used via a library in the Java SDK
| Conscrypt.setNamedGroups(sslSocket, groups); | ||
| return socket; | ||
| } | ||
| // 2. Otherwise (user-provided security provider or JDK fallback), try standard JSSE |
There was a problem hiding this comment.
Is this a case that we have to support? This is a generic http library and I don't think we have to try to enable PQC by default. As long as we expose an option and users (including GAPIC/Apiary libraries) can set the PQC algorithm then we should be good.
There was a problem hiding this comment.
I'll double check the requirements. The earlier design mentioned that we will support PQC by default in the http-client. This functionality mirrors what gRPC-Java is doing which enables it by default (both being general purpose libraries)
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
3 times, most recently
from
943111f to
55b200c
Compare
…ed groups configuration TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
lqiu96
force-pushed
the
pqc-support-conscrypt
branch
from
55b200c to
0f4489c
Compare
2 participants
Adds fallback logic in NetHttpTransport to default to Conscrypt for SSLContext and fall back to the standard JDK TLS if Conscrypt is not available. Enables setting a custom security provider on the builder which takes precedence. Enforces PQC hybrid named groups (X25519MLKEM768, X25519) on Conscrypt sockets via a wrapped SSLSocketFactory.