OPS packet: Default to new packet format - #2347
Open
vanitasvitae wants to merge 4051 commits into
Open
Conversation
…lenge (parser robustness)
Fix StringIndexOutOfBoundsException parsing a malformed EST auth challenge (parser robustness) See merge request root/bc-java!222
Use constant-time comparison for secret-bearing private-key `equals()` See merge request root/bc-java!223
…signed byte arrays BigInteger.toByteArray() prepends a two's-complement sign byte when the MSB is set, so two values of the same bit-length can serialise to different lengths (256 vs 257 bytes for a 2048-bit value) purely on that bit, which the variable-time Arrays.constantTimeAreEqual then leaks. Size both operands from their own unsigned byte lengths (the larger of the two) and compare the unsigned fixed-length forms; this drops the sign byte and makes the comparison length-uniform. Not perfectly constant-time -- toByteArray() in the conversion still scales with magnitude -- but it removes the high-bit length signal. Boolean result unchanged (checked against BigInteger.equals over 50k random pairs); no caller changes.
…arse time Features, TrustSignature, SignatureTarget, RevocationKey and RevocationReason index a fixed offset of their body from their accessors (e.g. Features.getFeatures() reads data[0], TrustSignature.getTrustAmount() reads data[1]) but their (boolean, boolean, byte[]) wire-parse constructor did not validate the body length. SignatureSubpacketInputStream accepts a subpacket whose length field is 1 (an empty body), so a truncated subpacket decoded cleanly and then threw ArrayIndexOutOfBoundsException when an accessor was read. Each parse constructor now runs verifyData(data), rejecting a body too short for its accessors with an IllegalArgumentException (surfaced as a MalformedPacketException by the parser), matching the existing IssuerFingerprint and IntendedRecipientFingerprint guards. The value-based constructors are unchanged.
Document the constant-time contract of BigIntegers.constantTimeAreEqual See merge request root/bc-java!224
…rusting revocation status
…ON2 and rename the calculator to JcePGPS2KCalculator
…qual and complete its javadoc
…mary HQC algorithm name with no-dash aliases
Standardised Classic McEliece (ISO/IEC 18033-2:2006/Amd 2:2026) See merge request root/bc-java!207
…ID assertion for standardised Classic McEliece
… the requested SNI after the handshake, relates to github bcgit#1773.
…s, a leftover of the expired draft-zauner-tls-aes-ocb, together with its module exports
…QC packages and added the missing package-info files for the aimer, qruov, sdith and xwing packages
…ferences to oid is provider code
…TRU+ decapsulation, DHAgreement peer validation, exception cause-chaining, the fixed-arity ASN.1 SEQUENCE guard batch, DSTU4145/OpenPGP/CRMF/TLS/DANE/TSP/ERS/SSH/EST robustness fixes, CMS RFC 5084 GCM parameters, X509CertificateReviewer, PKCS12 default iteration count, Mayo OQS OIDs, Ed25519 expanded keys, ECDHRawAgreement, ML-DSA and DH performance work, name finder and ASN.1 limit constants
…phaning the continuation of an entry) and specifications.html (stray bold closers in the cipher tables, unmatched paragraph closes, XSalsa20 IV size corrected to 192 bits)
…the provider module descriptor, matching the compositesignatures package
…m set: ARIA, GIFT-COFB, Romulus, RFC 5649 wrap, ChaCha7539/XChaCha20, VMPC-KSA3, LEA, Shacal-2, GOST3412-2015, additional Blake2 variants, SHA-512/t, KMAC/KGMac/Blake3Mac, X25519/X448 and PAKE agreement, SAKKE, NTRU+, X-Wing, the ISO 18033-2 Classic McEliece sets, the provider KEM and PQC signature listings, HASH-ML-DSA and Argon2
…leset after the github bcgit#2176 consolidation into core, and replaced System.clearProperty with getProperties().remove in PKIXNameConstraintsTest for the 1.4 API floor.
…vate tests MayoRetryTest and HttpUtilTest which sit in signed main packages. Moved them out of the shared pqc.crypto.test/est.test AllTests into package-local AllTests (run by Gradle) and dropped those from the signed-jar test staging, matching the lms/keybox pattern.
…qcMalformedInputTest so the -source 1.5 compile accepts the anonymous Runnable captures (Java 8 effectively-final let the Gradle build through).
…to a pre-2024 fork, reintroducing the AES-CCM tag bug (CCM params routed through GCMParameters, rejected as 'Invalid ICV length: 8' on JRE 5 BCFKS/PKCS AEAD paths). Regenerated from base keeping the sole JRE-5 adaptation - avoiding the Java 8 PBEParameterSpec.getParameterSpec().
…atching jdk18+.xml: keeps the package-private tests in signed main packages out of the unsigned test jar (the bc+-build.xml AllTests deletes already prevented the clash; this stops them being compiled at all).
…ata version by default; add opt-in org.bouncycastle.cms.signeddata.preserve_version to carry the original version over verbatim for Authenticode interop (version 1 with a non-id-data eContentType). Adds a SignedData ctor taking an explicit version, relates to github bcgit#2344.
…silently dropping key blobs that follow a free/deleted slot; empty blobs are now skipped and parsing continues, relates to github bcgit#2343.
…non-tagged unsignedAttrs with IllegalArgumentException instead of leaking a ClassCastException, decoding via getInstance to match asn1.pkcs.SignerInfo, relates to github bcgit#2342.
…tension parsers CertificatePolicies, PolicyMappings, ExtendedKeyUsage, CRLDistPoint and SubjectDirectoryAttributes, matching AuthorityInformationAccess/NameConstraints, relates to github bcgit#2331.
… KMIPInputStream XXE (DTD/external-entity) hardening, relates to github bcgit#2315.
…ibution point so it survives the empty-SEQUENCE CRLDistPoint hardening, relates to github bcgit#2331.
…rdMaxTime <= elapsed) to match the javadoc and hard-fail at exactly maxTime; removes the same-millisecond flakiness that RevocationTest.testRevokedEndEntityWithSoftFailure papered over with a 1s Thread.sleep, now dropped.
…ignedData.asVersion(int) method that returns a copy with the version field forced, so a producer (e.g. Authenticode needing version 1) can pin it explicitly per-instance while replaceSigners/addDigestAlgorithm keep recomputing the RFC 5652 version by default, relates to github bcgit#2344.
… OpenPGP notation subpacket header is 8 octets, so a body declaring more name/value than it carried passed the check and overran in getNotationName/getNotationValueBytes; now counts the full header, relates to github bcgit#2346.
…riants in SphincsPlusTest (and its jdk1.3 mirror): the OIDs were already wired, so the FIXME skip was stale; add parameter-identity assertions to catch future OID/parameter mapping regressions, relates to github bcgit#2345.
…the OID-only KeyGenerator registrations (SM4/ARIA GCM-CCM, ARIA and DSTU7624 key wrap, SEED CMS wrap, DSTU7624 GMAC, legacy AES OIDs) and the generic EC keypair generator, removing the last unknown-primitive assets from the CBOM.
Contributor
|
I've uploaded a new jar to https://www.bouncycastle.org/betas - with the patch, I changed it as the original one is on the parser, I suspect just an accident. One thing, it defaults to new for V6, but legacy will still work okay, if you set PacketFormat.CURRENT it should run with the new style for everything though. |
hubot
pushed a commit
that referenced
this pull request
Jul 14, 2026
…rmat on generation (mirroring the v6 SignaturePacket constructor) so a v6 OPS packet emitted via PGPSignatureGenerator under the default ROUNDTRIP encoding no longer gets a Legacy header, per RFC 9580 sec. 4.2; v3 OPS keeps the Legacy default, relates to github #2347.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey!
Someone noticed that BC still defaults to the old legacy packet format when emitting OnePassSignaturePackets.
This patch changes the default value to the new packet format.