Update README supported-algorithms list - #559
Draft
WillChilds-Klein wants to merge 1 commit into
Draft
Conversation
Reconcile the README's "Supported Algorithms" section against ACCP's
actual service registrations. The list was compiled two ways and merged:
by reading the addService/addSignatures calls in
AmazonCorrettoCryptoProvider, and by enumerating Provider.getServices() on
a live ACCP instance (2.6.0, non-FIPS, JDK 17).
Changes:
- SecretKeyFactory: add the PBKDF2WithHmacSHA{1,224,256,384,512}
factories (added in corretto#543 after this section was last updated).
- KeyPairGenerator / KeyFactory: add the ML-DSA{,-44,-65,-87} and
ML-KEM{,-512,-768,-1024} entries, and note the XDH alias for X25519.
- KEM: enumerate the sized ML-KEM-512/768/1024 variants alongside ML-KEM.
- KeyAgreement: note the XDH alias for X25519.
- Signature: correct Ed25519/Ed25519ph casing, note the EdDSA alias, and
collapse the ML-DSA entries.
- Mark build/mode-conditional algorithms accordingly: AES/CFB, Ed25519ph,
NONEwithEd25519ph, and ML-DSA are non-FIPS only; ML-KEM requires a
JDK 17+ build.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #559 +/- ##
=========================================
Coverage 78.55% 78.55%
Complexity 1217 1217
=========================================
Files 127 127
Lines 7759 7759
Branches 982 982
=========================================
Hits 6095 6095
Misses 1133 1133
Partials 531 531 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available: N/A
Description of changes:
The README's "Supported Algorithms" section had drifted from what ACCP actually registers. I reconciled it two ways and merged the results:
addService(...)/addSignatures()calls inAmazonCorrettoCryptoProvider, including the build/mode-conditional registrations (shouldRegisterMLDSA,shouldRegisterMLKEM,shouldRegisterAesCfb,shouldRegisterX25519,shouldRegisterEd25519ph,shouldRegisterEdKeyFactory).Provider.getServices()on a live ACCP instance (2.6.0, non-FIPS, JDK 17) and grouped by service type.Reconciled changes:
PBKDF2WithHmacSHA{1,224,256,384,512}(added in Add support for PBKDF2 #543 after this section was last updated).ML-DSA{,-44,-65,-87}andML-KEM{,-512,-768,-1024}entries; noted theXDHalias forX25519.ML-KEM-512/768/1024variants alongsideML-KEM.XDHalias forX25519.Ed25519/Ed25519phcasing (wereED25519/ED25519ph), noted theEdDSAalias, and collapsed theML-DSAentries.AES/CFB,Ed25519ph,NONEwithEd25519ph, andML-DSAare non-FIPS only;ML-KEMrequires a JDK 17+ build.Notes:
getServices()dump reflects the default build (non-FIPS, JDK 17), soML-KEMis absent from it (compiled out of the default build) and the ML-DSA/AES-CFB/Ed25519ph entries are present; the README annotates these gating conditions rather than omitting the algorithms.AES/CBC/PKCS5Padding) rather than the bare registration names (AES/CBC+SupportedModes), which is the more useful form for callers; left as-is aside from the AES/CFB FIPS annotation.PSSParameterSpec, not a separately registered service, so it does not appear ingetServices()and needs no new list entry.Verified the reconciliation by diffing the updated README against the
getServices()output.By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.