GH-803: use JDK built-in ML-KEM on Java24+

Add KEMs to SecurityUtils and SecurityEntityFactories. Configure the
"SunJCEWrapper" SecurityProviderRegistrar to include support for ML-KEM
if it is available in Java's SunJCE security provider.

Rename interface KeyEncapsulationMethod to KEM: this serves now as a
wrapper around different KEM implementations from Bouncy Castle or from
the JDK. Because the class name is user-visible in the security provider
registrar configuration, using KEM minimizes confusions.

Move the Bouncy Castle implementations from sshd-core to sshd-common
where the rest of BC-specific stuff lives. Add a JceKEM factory to
create KEM instances if supported by the platform. This default factory
always throws NoSuchAlgorithmException.

In the multi-release section for Java 24, add a real JceKEM factory that
returns instances of our own KEM wrapper class that internally use
javax.crypto.KEM.

Change the Github workflows to use Java 25 for compiling, and run the
tests on Java 8, 17, and 25. (Previously we tested on 8, 11, and 17.)

The new JDK ML-KEM support is tested in the "multirelease" execution of
the maven-failsafe-plugin in bundle sshd-test in test OpenSshMlKemTest.

Author: tomaswolf

.github/workflows/build.yml

@@ -35,7 +35,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java: [ '17' ]
+        java: [ '25' ]
     steps:
       - uses: actions/checkout@v4
 
@@ -66,7 +66,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest, windows-latest ]
-        java: [ '8', '11', '17' ]
+        java: [ '8', '17', '25' ]
     steps:
       - uses: actions/checkout@v4
 
@@ -76,7 +76,7 @@ jobs:
           distribution: temurin
           java-version: |
             ${{ matrix.java }} 
-            17
+            25
 
       - uses: actions/cache@v4
         with:

.github/workflows/master-build.yml

@@ -52,7 +52,7 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '25'
           # Create a ~/.m2/settings.xml referencing these environment variable names
           server-id: 'apache.snapshots.https'
           server-username: NEXUS_USERNAME

.github/workflows/next-build.yml

@@ -52,7 +52,7 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '25'
           # Create a ~/.m2/settings.xml referencing these environment variable names
           server-id: 'apache.snapshots.https'
           server-username: NEXUS_USERNAME

CHANGES.md

@@ -66,3 +66,7 @@ Complete refactoring of the SSH transport protocol. New feature: support for cli
   the version used in SSH. Since the Poly1305 MAC in Java is not accessible separately, Apache MINA SSHD still
   has to use its own implementation for that part.)
 
+* [GH-803](https://github.com/apache/mina-sshd/issues/803) Support the JDK built-in ML-KEMs on Java24+
+
+  Use the ML-KEM implementations from SunJCE if run on Java >= 24. For Java < 24, The Bouncy Castle implementations
+  are used. The SunJCE ML-KEMs are advertised in the `SunJCESecurityProviderRegistrar`.

pom.xml

@@ -72,7 +72,7 @@
 
     <properties>
         <japicmp-sshd-last-release>2.16.0</japicmp-sshd-last-release>
-        <minimalJavaBuildVersion>17</minimalJavaBuildVersion>
+        <minimalJavaBuildVersion>24</minimalJavaBuildVersion>
         <surefireJdk>[${minimalJavaBuildVersion},)</surefireJdk>
         <minimalMavenBuildVersion>3.9.8</minimalMavenBuildVersion>
 

sshd-common/pom.xml

@@ -200,6 +200,19 @@
                             <release>15</release>
                         </configuration>
                     </execution>
+                    <execution>
+                        <id>compile-24</id>
+                        <goals>
+                            <goal>compile</goal>
+                        </goals>
+                        <configuration>
+                            <compileSourceRoots>
+                                <compileSourceRoot>${project.basedir}/src/main/java24</compileSourceRoot>
+                            </compileSourceRoots>
+                            <multiReleaseOutput>true</multiReleaseOutput>
+                            <release>24</release>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
         </plugins>

sshd-common/src/main/java/org/apache/sshd/common/util/security/JceKEM.java

@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sshd.common.util.security;
+
+import java.security.NoSuchAlgorithmException;
+import java.security.Provider;
+
+enum JceKEM implements KEMFactory {
+
+    INSTANCE;
+
+    @Override
+    public KEM get(String algorithm, Provider provider) throws NoSuchAlgorithmException {
+        throw new NoSuchAlgorithmException();
+    }
+
+    @Override
+    public boolean isSupported(String algorithm) {
+        return false;
+    }
+}

…d/common/kex/KeyEncapsulationMethod.java …pache/sshd/common/util/security/KEM.javasshd-core/src/main/java/org/apache/sshd/common/kex/KeyEncapsulationMethod.java renamed to sshd-common/src/main/java/org/apache/sshd/common/util/security/KEM.java sshd-core/src/main/java/org/apache/sshd/common/kex/KeyEncapsulationMethod.java renamed to sshd-common/src/main/java/org/apache/sshd/common/util/security/KEM.java

@@ -16,12 +16,20 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.sshd.common.kex;
+package org.apache.sshd.common.util.security;
+
+import org.apache.sshd.common.OptionalFeature;
 
 /**
  * General interface for key encapsulation methods (KEM).
  */
-public interface KeyEncapsulationMethod {
+public interface KEM extends OptionalFeature {
+
+    String ML_KEM_768 = "ML-KEM-768";
+
+    String ML_KEM_1024 = "ML-KEM-1024";
+
+    String SNTRUP_761 = "SNTRUP-761";
 
     /**
      * Client-side KEM operations.

sshd-common/src/main/java/org/apache/sshd/common/util/security/KEMFactory.java

@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sshd.common.util.security;
+
+import java.security.NoSuchAlgorithmException;
+import java.security.Provider;
+
+public interface KEMFactory {
+
+    default KEM get(String algorithm) throws NoSuchAlgorithmException {
+        return get(algorithm, null);
+    }
+
+    KEM get(String algorithm, Provider provider) throws NoSuchAlgorithmException;
+
+    default boolean isSupported(String algorithm) {
+        try {
+            KEM kem = get(algorithm);
+            return kem.isSupported();
+        } catch (Throwable t) {
+            return false;
+        }
+    }
+
+}

sshd-common/src/main/java/org/apache/sshd/common/util/security/SecurityEntityFactory.java

@@ -76,6 +76,10 @@ default SecureRandom createSecureRandom(String algorithm) throws GeneralSecurity
         throw new NoSuchAlgorithmException("Algorithm '" + algorithm + "' not supported (default)");
     }
 
+    default KEM createKEM(String algorithm) throws GeneralSecurityException {
+        throw new NoSuchAlgorithmException("Algorithm '" + algorithm + "' not supported (default)");
+    }
+
     class Named implements SecurityEntityFactory {
 
         private final String name;
@@ -232,5 +236,10 @@ public Signature createSignature(String algorithm) throws GeneralSecurityExcepti
         public SecureRandom createSecureRandom(String algorithm) throws GeneralSecurityException {
             return SecureRandom.getInstance(algorithm);
         }
+
+        @Override
+        public KEM createKEM(String algorithm) throws GeneralSecurityException {
+            return JceKEM.INSTANCE.get(algorithm);
+        }
     }
 }