Tls injection mechanism

.gitignore

@@ -12,6 +12,7 @@
 bin/
 build/
 */build/
+libs/*.jar
 out/
 */out/
 .settings/

.gitlab-ci.yml

@@ -1,30 +1,113 @@
 stages:
   - check
+  - build
   - test
 
 check-code:
   stage: check
   script:
-    - "apply_overlay bc-java ./"
-    - ". cienv.sh; \ gradle check -x test;"
-
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/check_java.sh\""
+  artifacts:
+    when: always
+    paths:
+      - "core/build/reports"
+      - "prov/build/reports"
+      - "pg/build/reports"
+      - "pkix/build/reports"
+      - "mail/build/reports"
+      - "util/build/reports"
+      - "tls/build/reports"
+      - "mls/build/reports"
+
+ant-build:
+  stage: build
+  needs: [ "check-code" ]
+  script:
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/build_1_8.sh\""
+
+
 test-code-8:
   stage: test
+  needs: [ "check-code" ]
   script:
-    - "apply_overlay bc-java ./"
-    - "sh gettestdata.sh"
-    - ". cienv-8.sh; \ gradle -stacktrace clean build;"
-
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/test_8.sh\""
+  artifacts:
+    when: always
+    reports:
+      junit:
+        - "core/build/test-results/**/*.xml"
+        - "prov/build/test-results/**/*.xml"
+        - "pg/build/test-results/**/*.xml"
+        - "pkix/build/test-results/**/*.xml"
+        - "mail/build/test-results/**/*.xml"
+        - "util/build/test-results/**/*.xml"
+        - "tls/build/test-results/**/*.xml"
+        - "mls/build/test-results/**/*.xml"
+
 test-code-11:
   stage: test
+  needs: [ "check-code" ]
   script:
-    - "apply_overlay bc-java ./"
-    - "sh gettestdata.sh"
-    - ". cienv-11.sh; \ gradle -stacktrace clean build;"
-
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/test_11.sh\""
+  artifacts:
+    when: always
+    reports:
+      junit:
+        - "core/build/test-results/**/*.xml"
+        - "prov/build/test-results/**/*.xml"
+        - "pg/build/test-results/**/*.xml"
+        - "pkix/build/test-results/**/*.xml"
+        - "mail/build/test-results/**/*.xml"
+        - "util/build/test-results/**/*.xml"
+        - "tls/build/test-results/**/*.xml"
+        - "mls/build/test-results/**/*.xml"
+
+
 test-code-17:
   stage: test
+  needs: [ "check-code" ]
+  script:
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/test_17.sh\""
+  artifacts:
+    when: always
+    reports:
+      junit:
+        - "core/build/test-results/**/*.xml"
+        - "prov/build/test-results/**/*.xml"
+        - "pg/build/test-results/**/*.xml"
+        - "pkix/build/test-results/**/*.xml"
+        - "mail/build/test-results/**/*.xml"
+        - "util/build/test-results/**/*.xml"
+        - "tls/build/test-results/**/*.xml"
+        - "mls/build/test-results/**/*.xml"
+
+
+test-code-21:
+  stage: test
+  needs: [ "check-code" ]
   script:
-    - "apply_overlay bc-java ./"
-    - "sh gettestdata.sh"
-    - ". cienv-17.sh; \ gradle -stacktrace clean build;"
+    - "ecr_login"
+    - "ecr_pull vm_base_intel latest"
+    - "ci_docker_run \"vm_base_intel:latest\" \"bc-java\" \"/workspace/bc-java/ci/test_21.sh\""
+  artifacts:
+    when: always
+    reports:
+      junit:
+        - "core/build/test-results/**/*.xml"
+        - "prov/build/test-results/**/*.xml"
+        - "pg/build/test-results/**/*.xml"
+        - "pkix/build/test-results/**/*.xml"
+        - "mail/build/test-results/**/*.xml"
+        - "util/build/test-results/**/*.xml"
+        - "tls/build/test-results/**/*.xml"
+        - "mls/build/test-results/**/*.xml"

CONTRIBUTORS.html

@@ -10,7 +10,7 @@
 <p>
 The following people and organisations donated financially to help with the release of Bouncy Castle:
 <br />&nbsp;<br />
-EduFer (1.72). Miguel, Rodolfo Hansen, and iterate GmbH (1.69). Encryptomatic.com (1.67). Denis Beurive, Ravi_02, and Manuel Corona (1.66). Christian Kahlo, Alexi Livshitz, and Denis Beurive (1.65). Joshua Hight (1.63). Bihari Babu (1.61).  Jens Neuhalfen and perillamint (1.60). Brian Reid (1.59). Joop Kaashoek and Pexus LLC (1.57).  DidiSoft, Cotiviti, Atanas Krachev, Encryptomatic LLC, LogicalAnswersIncSupporter (1.56).  Digistamp, RAM NAG (1.55).  Lobster GmbH (1.54).  Sheba, Ishmal Bartley, and Li-Chang Johnny Lo (1.53). lecker&#064buetterchen.de, Charles Proxy, Gunny Mills, Morgan Le Douget, Ben Whitaker, and Emilio Navarrete Lineros (1.52).  Gup & Boz &#64 Alki Seattle, Bytemine Gmbh, Ted Pennings, Atanas Krachev, PrimeKey Solutions AB, Martin Paljak, CorseraFri19980116, CPU Terminator, Lindsay Bradford, kares, Philius, and Aaron Anderson (1.51).
+AXL Software, Larry West (California), A-Sher (1.77). EduFer (1.72). Miguel, Rodolfo Hansen, and iterate GmbH (1.69). Encryptomatic.com (1.67). Denis Beurive, Ravi_02, and Manuel Corona (1.66). Christian Kahlo, Alexi Livshitz, and Denis Beurive (1.65). Joshua Hight (1.63). Bihari Babu (1.61).  Jens Neuhalfen and perillamint (1.60). Brian Reid (1.59). Joop Kaashoek and Pexus LLC (1.57).  DidiSoft, Cotiviti, Atanas Krachev, Encryptomatic LLC, LogicalAnswersIncSupporter (1.56).  Digistamp, RAM NAG (1.55).  Lobster GmbH (1.54).  Sheba, Ishmal Bartley, and Li-Chang Johnny Lo (1.53). lecker&#064buetterchen.de, Charles Proxy, Gunny Mills, Morgan Le Douget, Ben Whitaker, and Emilio Navarrete Lineros (1.52).  Gup & Boz &#64 Alki Seattle, Bytemine Gmbh, Ted Pennings, Atanas Krachev, PrimeKey Solutions AB, Martin Paljak, CorseraFri19980116, CPU Terminator, Lindsay Bradford, kares, Philius, and Aaron Anderson (1.51).
 </p>
 <p>
 We also wish to acknowledge financial and collaborative support from <a href="https://www.cisco.com/">CISCO</a> and additional financial support from <a href="https://www.primekey.com/">PrimeKey</a> towards developing the EST API for RFC 7030 support.
@@ -384,7 +384,7 @@
 <li>Tobias Wich&lt;tobias.wich&#064ecsec.de&gt; Provided patch for TLS to work around servers sending Supported Elliptic Curves extension unexpectedly.</li>
 <li>Hauke Mehrtens&lt;hauke&#064hauke-m.de&gt; TLS patch to add ECDHE_ECDSA CCM ciphersuites from RFC 7251.</li>
 <li>Daniel Zimmerman&lt;dmz&#064galois.com&gt; Further key quality improvements to RSAKeyPairGenerator.</li>
-<li>Jens Kapitza&ltj.kapitza&#064schwarze-allianz.de&gt; Iterable support in OpenPGP API, code cleanup in OpenPGP API.</li>
+<li>Jens Kapitza&lt;j.kapitza&#064schwarze-allianz.de&gt; Iterable support in OpenPGP API, code cleanup in OpenPGP API.</li>
 <li>Johan Eklund&lt;johan&#064primekey.se&gt; update to RFC 6960 for OCSPObjectIdentifiers.</li>
 <li>nikosn&lt;https://github.com/nikosn&gt; Fix to encoding of EC private keys to ensure encoding matches order length.</li>
 <li>Axel von dem Bruch &lt;axel-vdb&#064riseup.net&gt; Contributions to BCrypt/OpenBSDBCrypt, original version of Blake2bDigest.</li>
@@ -441,18 +441,18 @@
 <li>David Strawn &lt;https://github.com/isomarcte&gt; fix for off by one error in SCRYPT bounds checking.</li>
 <li>chris mccown &lt;0xchrismccown&#064gmail.com&gt; identification of serialisation issue with XMSS/XMSSMT private keys (see also CVE-2018-1000613).</li>
 <li>ZZMarquis &lt;https://github.com/ZZMarquis&gt; offset patches for SM2 encryption and decryption, improvement to Array constant time comparison.</li>
-<li>Andreas Kretschmer &lt;https://github.com/Akretsch&gt; NPE fix for CertTemplate.getVersion()</li>
+<li>Andreas Kretschmer, Siemens AG &lt;https://github.com/Akretsch&gt; NPE fix for CertTemplate.getVersion(), ASN.1 KEM Support classes for CMP.</li>
 <li>Armin Lunkeit, Michael Tautenhahn &lt;&gt; identification of M-R test issue on higher certainty values in RSA key pair generation.</li> 
 <li>Vincent Breitmoser &lt;https://github.com/Valodim&gt; fix to ignore unnecessary checksum calculator on PGP secret key encryption.</li>
 <li>Adam Vartanian &lt;https://github.com/flooey&gt; use of ShortBuffer exception and buffer size pre-check in Cipher.doFinal().</li>
 <li>Bernd &lt;https://github.com/ecki&gt; Fix to make PGPUtil.pipeFileContents use buffer and not leak file handle.</li>
 <li>Shartung &lt;https://github.com/shartung&gt; Additional EC Key Agreement algorithms in support of German BSI TR-03111.</li>
-<li>Paul Schaub &lt;https://github.com/vanitasvitae&gt; bringing PGPSecretKey.getUserIds() into line with PGPPublicKey.getUserIds(). Exception message fix in BcPublicKeyDataDecryptorFactory. Additional tests on PGP key ring generation. Improved functionality of PGPSignatureSubpacketGenerator, PGPPublicKeyRing. Tweaks to PGPDataEncryptorBuilder interface, fix for JcaPGP/BcPGP Ed25519 private key conversion. Added configurable CRC detection to ArmoredInputStream, additional control character skipping in ArmoredInputStream. Rewind code for PGPPBEEncryptedData, addition of PGPSignature.getDigestPrefix(). Wrong list traversal fix in PGPSecretKeyRing. Further improvement to use of generics in PGP API. General interop improvements. PGP Public / Secure keyring ignore marker packets when reading. Initial work on PGP session key handling, filtering literal data for canoncialization. Addition of direct key identified key-ring construction. PGPSecretKeyRing.insertOrReplacePublicKey addition. Addition of utility methods for joining/merging signatures and public keys. Addition of PGP regexp packet, PolicyURI packet handling, UTF8 comment testing. Efficiency improvements to TruncatedStream. Initial Argon2 support for OpenPGP. General cleanups. Fast CRC24 implementation, SHA3 addtions to BcImplProvider, improvements to One Pass Signature support, read() consistency in BCPGInputStream. Contributions to AEAD support in PGP API.</li>
+<li>Paul Schaub &lt;https://github.com/vanitasvitae&gt; bringing PGPSecretKey.getUserIds() into line with PGPPublicKey.getUserIds(). Exception message fix in BcPublicKeyDataDecryptorFactory. Additional tests on PGP key ring generation. Improved functionality of PGPSignatureSubpacketGenerator, PGPPublicKeyRing. Tweaks to PGPDataEncryptorBuilder interface, fix for JcaPGP/BcPGP Ed25519 private key conversion. Added configurable CRC detection to ArmoredInputStream, additional control character skipping in ArmoredInputStream. Rewind code for PGPPBEEncryptedData, addition of PGPSignature.getDigestPrefix(). Wrong list traversal fix in PGPSecretKeyRing. Further improvement to use of generics in PGP API. General interop improvements. PGP Public / Secure keyring ignore marker packets when reading. Initial work on PGP session key handling, filtering literal data for canoncialization. Addition of direct key identified key-ring construction. PGPSecretKeyRing.insertOrReplacePublicKey addition. Addition of utility methods for joining/merging signatures and public keys. Addition of PGP regexp packet, PolicyURI packet handling, UTF8 comment testing. Efficiency improvements to TruncatedStream. Initial Argon2 support for OpenPGP. General cleanups. Fast CRC24 implementation, SHA3 addtions to BcImplProvider, improvements to One Pass Signature support, signatue validation, read() consistency in BCPGInputStream. Contributions to AEAD support (v6 & v5) in PGP API. Addition of PGP WildCard ID, moving the PGP example code into the 21st century. Security patches for encrypted data generation, initial thread safe certification verification. Support for V6 EC keys, PGP packet criticality, and Preferred AEAD CipherSuites sigsubpacket support.</li>
 <li>Nick of Nexxar &lt;https://github.com/nros&gt; update to OpenPGP package to handle a broader range of EC curves.</li>
 <li>catbref &lt;https://github.com/catbref&gt; sample implementation of RFC 7748/Ed25519 (incorporated work from github users Valodim and str4d as well).</li>
 <li>gerlion &lt;https://github.com/gerlion&gt; detection of concurrency issue with pre-1.60 EC math library.</li>
 <li>fgrieu &lt;fgrieu&#064gmail.com&gt; identification and suggested fixes for possible timing vulnerability in OAEPEncoding and RSACoreEngine.</li>
-<li>MTG &lt;https://github.com/mtgag&gt; patch for decoding issues in PKIPublicationInfo and CertifiedKeyPair.</li>
+<li>MTG &lt;https://github.com/mtgag&gt; patch for decoding issues in PKIPublicationInfo and CertifiedKeyPair, patch for adding jurisdiction{C,ST,L} to X500 name style.</li>
 <li>Andreas Gadermaier &lt;up.gadermaier&#064gmail.com&gt; initial version of Argon2 PBKDF algorithm.</li>
 <li>Tony Washer &lt;tony.washer&#64yahoo.co.uk&gt; review of qTesla, Java 1.9 module code, additional test code and debugging for GOST, DSTU, and ECNR algorithms. Initial lightweight implementation of the ZUC ciphers and macs. Additions to LMS/HSS API implementations, fix for truncation issue with big HSS keys, contributions to optimization of LMS/HSS. Patch for XDH/EdDSA key handling and mcEliece decryption using kobaraImai. Initial GCM-SIV, Blake3, and Kangaroo implementation.</li>
 <li>Vincent Bouckaert &lt;https://github.com/veebee&gt; initial version of RFC 4998 ASN.1 classes. Debugging and testing of high level RFC 4998 implementation.</li>
@@ -488,7 +488,7 @@
 <li>vvvlado &lt;https://github.com/vvvlado&gt; Fix to support repeated headers in PGP armored data.</li>
 <li>a--v--k &lt;https://github.com/a--v--k&gt; Clean up for some invalid mappings in the Java provider.</li>
 <li>lipnitsk &lt;https://github.com/lipnitsk&gt; Fix for non-CRT RSA Private serialisation.</li>
-<li>Niccolò Fontana &lt;https://github.com/NicFontana&gt; Initial fix for high-latency DTLS HelloVerifyRequest handshakes.</li>
+<li>Niccol&ograve; Fontana &lt;https://github.com/NicFontana&gt; Initial fix for high-latency DTLS HelloVerifyRequest handshakes.</li>
 <li>sudheernv &lt;https://github.com/sudheernv&gt; Patch for KMAC rightEncode() encoding.</li>
 <li>Mathias Neuhaus &lt;https://github.com/mneuhaus-cv&gt; Patch for cSHAKE extra padding on block aligned N and S bug.</li>
 <li>Yuri Schimke &lt;https://github.com/yschimke&gt; Patch for nested exception handling in BcKeyStoreSpi.</li>
@@ -529,7 +529,24 @@
 <li>Amazon AWS Security Team - isolation and identification of performance bottlenecks in the BC PEM parsing support.</li>
 <li>Phillip Schichtel &lt;https://github.com/pschichtel&gt; - initial code for specifying wrapping algorithm with PGP PBE encryption method, forcing of session key usage.</li>
 <li>Alexander Dippel &lt;https://github.com/adippel&gt; - corrections to prevent NPEs on chunked encoding of EST responses.</li>
-<li>Johann N. Löfflmann &lt;https://github.com/jonelo&gt; - fix to "too small" buffer issue in Blake2sp.</li>
+<li>Johann N. L&ouml;fflmann &lt;https://github.com/jonelo&gt; - fix to "too small" buffer issue in Blake2sp.</li>
+<li> Scott Xu &lt;https://github.com/scott-xu&gt; - message fix in OpenSSHPublicKeyUtil</li>
+<li>Scott Arciszewski &lt;https://github/scottarc&gt; - correction to ant scripts to ensure UTF8 support.</li>
+<li>GitHub Security team - identification of the X509LDAPCertStoreSpi wildcard bug (see CVE-2023-33201).</li>
+<li>James Howe &lt;https://github.com/OrangeDog&gt; - improvement to cross-provider compatibility in JcaPKCS10CertificationRequest.</li>
+<li>Steffen Heil &lt;https://github.com/steffen-heil&gt; - correction to error handling in Arrays.getLength().</li>
+<li>Thomas D. &lt;https://github.com/thomdev&gt; - expansion of HPKE APIs, addition of user controlled ephemeral key to HPKE API.</li>
+<li>Franz Fangmeyer &lt;https://github.com/ff-wl&gt; - exception handling for improper use of '=' in an X.500 RDN.</li>
+<li>Jonathan Lennox &lt;https://github.com/JonathanLennox&gt; - fix DTLS retransmission bug with aggregated ChangeCipherSpec.</li>
+<li>Thomas Devanneaux &lt;tdevanneaux&#064apple.com&gt; - extensions to the HPKE API to support encryption/decryption from byte ranges, allow sender selected ephemeral key.</li>
+<li>Norman Maurer &lt;norman_maurer&#064apple.com&gt; - extensions to the HPKE API to support encryption/decryption from byte ranges, allow sender selected ephemeral key.</li>
+<li>Bing Shi &lt;roadicing&#064gmail.com&gt; - addition of F2m bounds checking for imported EC F2m curves.</li>
+<li>Phil Brown &lt;https://github.com/brownp2k&gt; - additional ant targets for building util and pkix.</li>
+<li>Tamas Cservenak &lt;https://github.com/cstamas&gt; - initial patch for supporting Ed25519 keys in GnuPG S-expressions.</li>
+<li>chchen-scholar &lt;https://github.com/chchen-scholar&gt; - encoding fix for EccP256CurvePoint.</li>
+<li>Seung Yeon &lt;https://github.com/seungyeonpark&gt; - addition of Memoable method implementations to CertPathValidationContext and CertificatePoliciesValidation.</li>
+<li>yuhh0328 &lt;https://github.com/yuhh0328&gt; - initial patch for adding ML-KEM support to TLS.</li>
+<li>Jan Oupick&yacute; &lt;https://github.com/Honzaik&gt; - update to draft 13 of composite PQC signatures.</li>
 </ul>
 </body>
 </html>

README.md

@@ -12,6 +12,51 @@ Except where otherwise stated, this software is distributed under a license base
 
 **Note**: this source tree is not the FIPS version of the APIs - if you are interested in our FIPS version please contact us directly at  [office@bouncycastle.org](mailto:office@bouncycastle.org).
 
+
+## Environmental Variables
+
+Before invoking gradlew you need to ensure the following environmental variables are defined and point
+to valid JAVA_HOMEs for each JVM version:
+
+```
+export BC_JDK8=/path/to/java8
+export BC_JDK11=/path/to/java11
+export BC_JDK17=/path/to/java17
+export BC_JDK21=/path/to/java21
+```
+
+## Building
+
+The project now uses ```gradlew``` which can be invoked for example:
+
+```
+# from the root of the project
+
+# Ensure JAVA_HOME points to JDK 17 or higher JAVA_HOME
+
+
+./gradlew clean build
+
+```
+
+The gradle script will endeavour to verify their existence but not the correctness of their value.
+
+
+## Multi-release jars and testing
+Some subprojects produce multi-release jars and these jars are tested in different jvm versions.
+Default testing on these projects is done on java 1.8 and there are specific test tasks for other versions.
+
+1. test11 test on java 11 JVM
+2. test17 test on java 17 JVM
+3. test21 test on java 21 JVM
+
+To run all of them:
+
+```
+./gradlew clean build test11 test17 test21
+```
+
+
 ## Code Organisation
 
 The clean room JCE, for use with JDK 1.1 to JDK 1.3 is in the jce/src/main/java directory. From JDK 1.4 and later the JCE ships with the JVM, the source for later JDKs follows the progress that was made in the later versions of the JCE. If you are using a later version of the JDK which comes with a JCE install please **do not** include the jce directory as a source file as it will clash with the JCE API installed with your JDK.