Skip to content

Commit ad0273a

Browse files
oscerdclaude
oscerd
and
claude
authored
CAMEL-23842: camel-pqc - use authenticated encryption (AEAD) in PQCDataFormat instead of ECB (#24348)
* CAMEL-23842: camel-pqc - use authenticated encryption (AEAD) in PQCDataFormat instead of ECB The PQC data format encrypted payloads with a bare cipher name (e.g. "AES"), which resolves to AES/ECB/PKCS5Padding: ECB leaks plaintext block structure and there is no IV or integrity protection, so the ciphertext is malleable and the DEM layer is not IND-CCA2 secure. The symmetric layer now uses authenticated encryption: 128-bit block ciphers are encrypted with GCM and the ChaCha20 stream cipher with ChaCha20-Poly1305. A random 12-byte nonce is written to the wire format and decryption verifies the auth tag via Cipher.doFinal (not CipherInputStream, which can silently swallow a tag failure), so tampered data is rejected. Only AEAD-capable symmetric algorithms are accepted; the non-AEAD legacy/stream ciphers (RC2, RC5, CAST5, GOST28147, DESEDE, GRAIN128, HC128, HC256, SALSA20) are rejected at startup. The DSL model enum, generated metadata, component docs and the 4.22 upgrade guide are updated accordingly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * CAMEL-23842: camel-pqc - remove dead bufferSize dataformat option and regenerate metadata Addresses review feedback on the AEAD change: - Remove the now-dead `bufferSize` dataformat option (it only configured the previous streaming implementation, which authenticated encryption replaced). Dropped from the component and core-model model (field, getter/setter, Builder) and from the hand-written reifier; regenerated the configurer, catalog/model metadata, XSD/YAML schemas and DSL writers/parsers. Documented in the docs and the 4.22 upgrade guide. - Regenerate camel-spring.xsd / camel-xml-io.xsd, which the earlier module-only build had left stale (this was the CI failure). - Upgrade guide: note that payloads are now processed in memory (the AEAD tag is verified before releasing plaintext) rather than streamed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com> --------- Signed-off-by: Andrea Cosentino <ancosen@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 19773e4 commit ad0273a

21 files changed

Lines changed: 365 additions & 235 deletions

File tree

‎catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/pqc.json‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,10 @@
1818
"properties": {
1919
"id": { "index": 0, "kind": "attribute", "displayName": "Id", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The id of this node" },
2020
"keyEncapsulationAlgorithm": { "index": 1, "kind": "attribute", "displayName": "Key Encapsulation Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLKEM", "BIKE", "HQC", "CMCE", "SABER", "FRODO", "NTRU", "NTRULPRime", "SNTRUPrime", "KYBER" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "MLKEM", "description": "The Post-Quantum KEM algorithm to use for key encapsulation." },
21-
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "RC2", "RC5", "CAMELLIA", "CAST5", "CAST6", "CHACHA7539", "DSTU7624", "GOST28147", "GOST3412_2015", "GRAIN128", "HC128", "HC256", "SALSA20", "SEED", "SM4", "DESEDE" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret." },
21+
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "CAMELLIA", "CAST6", "DSTU7624", "GOST3412_2015", "SEED", "SM4", "CHACHA7539" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret. Only algorithms that support authenticated encryption (AEAD) are allowed: AES, ARIA, CAMELLIA, CAST6, DSTU7624, GOST3412_2015, SEED and SM4 are encrypted with GCM, and CHACHA7539 with ChaCha20-Poly1305." },
2222
"symmetricKeyLength": { "index": 3, "kind": "attribute", "displayName": "Symmetric Key Length", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 128, "description": "The length (in bits) of the symmetric key." },
2323
"keyPair": { "index": 4, "kind": "attribute", "displayName": "Key Pair", "group": "common", "required": false, "type": "object", "javaType": "java.security.KeyPair", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to the KeyPair to lookup from the registry to use for KEM operations." },
24-
"bufferSize": { "index": 5, "kind": "attribute", "displayName": "Buffer Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 4096, "description": "The size of the buffer used for streaming encryption\/decryption." },
25-
"provider": { "index": 6, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
26-
"keyGenerator": { "index": 7, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
24+
"provider": { "index": 5, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
25+
"keyGenerator": { "index": 6, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
2726
}
2827
}

‎catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/pqc.json‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,10 @@
1515
"properties": {
1616
"id": { "index": 0, "kind": "attribute", "displayName": "Id", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The id of this node" },
1717
"keyEncapsulationAlgorithm": { "index": 1, "kind": "attribute", "displayName": "Key Encapsulation Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLKEM", "BIKE", "HQC", "CMCE", "SABER", "FRODO", "NTRU", "NTRULPRime", "SNTRUPrime", "KYBER" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "MLKEM", "description": "The Post-Quantum KEM algorithm to use for key encapsulation." },
18-
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "RC2", "RC5", "CAMELLIA", "CAST5", "CAST6", "CHACHA7539", "DSTU7624", "GOST28147", "GOST3412_2015", "GRAIN128", "HC128", "HC256", "SALSA20", "SEED", "SM4", "DESEDE" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret." },
18+
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "CAMELLIA", "CAST6", "DSTU7624", "GOST3412_2015", "SEED", "SM4", "CHACHA7539" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret. Only algorithms that support authenticated encryption (AEAD) are allowed: AES, ARIA, CAMELLIA, CAST6, DSTU7624, GOST3412_2015, SEED and SM4 are encrypted with GCM, and CHACHA7539 with ChaCha20-Poly1305." },
1919
"symmetricKeyLength": { "index": 3, "kind": "attribute", "displayName": "Symmetric Key Length", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 128, "description": "The length (in bits) of the symmetric key." },
2020
"keyPair": { "index": 4, "kind": "attribute", "displayName": "Key Pair", "group": "common", "required": false, "type": "object", "javaType": "java.security.KeyPair", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to the KeyPair to lookup from the registry to use for KEM operations." },
21-
"bufferSize": { "index": 5, "kind": "attribute", "displayName": "Buffer Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 4096, "description": "The size of the buffer used for streaming encryption\/decryption." },
22-
"provider": { "index": 6, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
23-
"keyGenerator": { "index": 7, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
21+
"provider": { "index": 5, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
22+
"keyGenerator": { "index": 6, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
2423
}
2524
}

‎catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9452,7 +9452,9 @@ The Post-Quantum KEM algorithm to use for key encapsulation. Default value: MLKE
94529452
<xs:annotation>
94539453
<xs:documentation xml:lang="en">
94549454
<![CDATA[
9455-
The symmetric encryption algorithm to use with the shared secret. Default value: AES
9455+
The symmetric encryption algorithm to use with the shared secret. Only algorithms that support authenticated encryption
9456+
(AEAD) are allowed: AES, ARIA, CAMELLIA, CAST6, DSTU7624, GOST3412_2015, SEED and SM4 are encrypted with GCM, and
9457+
CHACHA7539 with ChaCha20-Poly1305. Default value: AES
94569458
]]>
94579459
</xs:documentation>
94589460
</xs:annotation>
@@ -9471,15 +9473,6 @@ The length (in bits) of the symmetric key. Default value: 128
94719473
<xs:documentation xml:lang="en">
94729474
<![CDATA[
94739475
Refers to the KeyPair to lookup from the registry to use for KEM operations.
9474-
]]>
9475-
</xs:documentation>
9476-
</xs:annotation>
9477-
</xs:attribute>
9478-
<xs:attribute name="bufferSize" type="xs:string">
9479-
<xs:annotation>
9480-
<xs:documentation xml:lang="en">
9481-
<![CDATA[
9482-
The size of the buffer used for streaming encryption/decryption. Default value: 4096
94839476
]]>
94849477
</xs:documentation>
94859478
</xs:annotation>

‎catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8574,7 +8574,9 @@ The Post-Quantum KEM algorithm to use for key encapsulation. Default value: MLKE
85748574
<xs:annotation>
85758575
<xs:documentation xml:lang="en">
85768576
<![CDATA[
8577-
The symmetric encryption algorithm to use with the shared secret. Default value: AES
8577+
The symmetric encryption algorithm to use with the shared secret. Only algorithms that support authenticated encryption
8578+
(AEAD) are allowed: AES, ARIA, CAMELLIA, CAST6, DSTU7624, GOST3412_2015, SEED and SM4 are encrypted with GCM, and
8579+
CHACHA7539 with ChaCha20-Poly1305. Default value: AES
85788580
]]>
85798581
</xs:documentation>
85808582
</xs:annotation>
@@ -8593,15 +8595,6 @@ The length (in bits) of the symmetric key. Default value: 128
85938595
<xs:documentation xml:lang="en">
85948596
<![CDATA[
85958597
Refers to the KeyPair to lookup from the registry to use for KEM operations.
8596-
]]>
8597-
</xs:documentation>
8598-
</xs:annotation>
8599-
</xs:attribute>
8600-
<xs:attribute name="bufferSize" type="xs:string">
8601-
<xs:annotation>
8602-
<xs:documentation xml:lang="en">
8603-
<![CDATA[
8604-
The size of the buffer used for streaming encryption/decryption. Default value: 4096
86058598
]]>
86068599
</xs:documentation>
86078600
</xs:annotation>

‎components/camel-pqc/src/generated/java/org/apache/camel/component/pqc/dataformat/PQCDataFormatConfigurer.java‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ public class PQCDataFormatConfigurer extends org.apache.camel.support.component.
2222
private static final Map<String, Object> ALL_OPTIONS;
2323
static {
2424
Map<String, Object> map = new CaseInsensitiveMap();
25-
map.put("BufferSize", int.class);
2625
map.put("KeyEncapsulationAlgorithm", java.lang.String.class);
2726
map.put("KeyGenerator", javax.crypto.KeyGenerator.class);
2827
map.put("KeyPair", java.security.KeyPair.class);
@@ -36,8 +35,6 @@ public class PQCDataFormatConfigurer extends org.apache.camel.support.component.
3635
public boolean configure(CamelContext camelContext, Object obj, String name, Object value, boolean ignoreCase) {
3736
PQCDataFormat target = (PQCDataFormat) obj;
3837
switch (ignoreCase ? name.toLowerCase() : name) {
39-
case "buffersize":
40-
case "bufferSize": target.setBufferSize(property(camelContext, int.class, value)); return true;
4138
case "keyencapsulationalgorithm":
4239
case "keyEncapsulationAlgorithm": target.setKeyEncapsulationAlgorithm(property(camelContext, java.lang.String.class, value)); return true;
4340
case "keygenerator":
@@ -61,8 +58,6 @@ public Map<String, Object> getAllOptions(Object target) {
6158
@Override
6259
public Class<?> getOptionType(String name, boolean ignoreCase) {
6360
switch (ignoreCase ? name.toLowerCase() : name) {
64-
case "buffersize":
65-
case "bufferSize": return int.class;
6661
case "keyencapsulationalgorithm":
6762
case "keyEncapsulationAlgorithm": return java.lang.String.class;
6863
case "keygenerator":
@@ -82,8 +77,6 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
8277
public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
8378
PQCDataFormat target = (PQCDataFormat) obj;
8479
switch (ignoreCase ? name.toLowerCase() : name) {
85-
case "buffersize":
86-
case "bufferSize": return target.getBufferSize();
8780
case "keyencapsulationalgorithm":
8881
case "keyEncapsulationAlgorithm": return target.getKeyEncapsulationAlgorithm();
8982
case "keygenerator":

‎components/camel-pqc/src/generated/resources/META-INF/org/apache/camel/component/pqc/dataformat/pqc.json‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,10 @@
1818
"properties": {
1919
"id": { "index": 0, "kind": "attribute", "displayName": "Id", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The id of this node" },
2020
"keyEncapsulationAlgorithm": { "index": 1, "kind": "attribute", "displayName": "Key Encapsulation Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "MLKEM", "BIKE", "HQC", "CMCE", "SABER", "FRODO", "NTRU", "NTRULPRime", "SNTRUPrime", "KYBER" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "MLKEM", "description": "The Post-Quantum KEM algorithm to use for key encapsulation." },
21-
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "RC2", "RC5", "CAMELLIA", "CAST5", "CAST6", "CHACHA7539", "DSTU7624", "GOST28147", "GOST3412_2015", "GRAIN128", "HC128", "HC256", "SALSA20", "SEED", "SM4", "DESEDE" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret." },
21+
"symmetricKeyAlgorithm": { "index": 2, "kind": "attribute", "displayName": "Symmetric Key Algorithm", "group": "common", "required": false, "type": "enum", "javaType": "java.lang.String", "enum": [ "AES", "ARIA", "CAMELLIA", "CAST6", "DSTU7624", "GOST3412_2015", "SEED", "SM4", "CHACHA7539" ], "deprecated": false, "autowired": false, "secret": false, "defaultValue": "AES", "description": "The symmetric encryption algorithm to use with the shared secret. Only algorithms that support authenticated encryption (AEAD) are allowed: AES, ARIA, CAMELLIA, CAST6, DSTU7624, GOST3412_2015, SEED and SM4 are encrypted with GCM, and CHACHA7539 with ChaCha20-Poly1305." },
2222
"symmetricKeyLength": { "index": 3, "kind": "attribute", "displayName": "Symmetric Key Length", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 128, "description": "The length (in bits) of the symmetric key." },
2323
"keyPair": { "index": 4, "kind": "attribute", "displayName": "Key Pair", "group": "common", "required": false, "type": "object", "javaType": "java.security.KeyPair", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to the KeyPair to lookup from the registry to use for KEM operations." },
24-
"bufferSize": { "index": 5, "kind": "attribute", "displayName": "Buffer Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 4096, "description": "The size of the buffer used for streaming encryption\/decryption." },
25-
"provider": { "index": 6, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
26-
"keyGenerator": { "index": 7, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
24+
"provider": { "index": 5, "kind": "attribute", "displayName": "Provider", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The JCE security provider to use." },
25+
"keyGenerator": { "index": 6, "kind": "attribute", "displayName": "Key Generator", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "javax.crypto.KeyGenerator", "deprecated": false, "autowired": false, "secret": false, "description": "Refers to a custom KeyGenerator to lookup from the registry for KEM operations." }
2726
}
2827
}

0 commit comments

Comments
 (0)