Open Hub
Open Hub

 Settings

1
I Use This!
Very High Activity

Commits : Listings

Analyzed about 1 hour ago. based on code collected about 19 hours ago.
Oct 26, 2025 — Oct 26, 2026
Commit Message Contributor Files Modified Lines Added Lines Removed Code Location Date
LMS parsing: Bound parsed seed length from above (Properties.LMS_MAX_SEED_LENGTH).
Peter Dettman
More... about 1 month ago
Refactor LMSEngine.generateHSSKeyPair
Peter Dettman
More... about 1 month ago
LMS: prehashed variants don't actually work - methods probably can be removed anyway
Peter Dettman
More... about 1 month ago
LMS: Move LM-OTS public key generation from a private key onto LMOtsPrivateKey.generatePublicKey, leaving LM_OTS the field-level operation
Peter Dettman
More... about 1 month ago
LMS: advanceRetainedPath reads the tree height from the key's own parameters rather than taking it as an argument
Peter Dettman
More... about 1 month ago
LMS: Express isTreeCachePrimed through peekRootT, which reads the same cached root
Peter Dettman
More... about 1 month ago
LMS: Drop the master secret length check in the HSS key's generateKey, which the LMS private key constructor it calls already makes, and name the parameter masterSecret as that constructor does
Peter Dettman
More... about 1 month ago
LMS: Say it is the master secret's length that is short in the LMS private key constructor's message
Peter Dettman
More... about 1 month ago
LMS: Name the derived seed of a replacement HSS tree childSeed, as the index reset does
Peter Dettman
More... about 1 month ago
LMS: Move the encoding of the HSS component keys and chaining signatures onto the Hierarchy snapshot that holds them
Peter Dettman
More... about 1 month ago
LMS: Hold the HSS component keys and chaining signatures as one immutable Hierarchy snapshot published by a single volatile write, so the accessors need no monitor, and rebuild every exhausted level over local arrays before publishing once, since a hierarchy published one level at a time pairs the fresh tree at level i with the signature the tree it replaced made over the still-exhausted level below it, ported from bc-csharp
Peter Dettman
More... about 1 month ago
Safer loop bound
Peter Dettman
More... about 1 month ago
BCFKS: accept an encoded scrypt parallelization parameter equal to either the configured one or the block size when a load store parameter's ScryptConfig is checked against an existing store, so a store round trips under the configuration that wrote it whichever way org.bouncycastle.bcfks.scrypt_p_eq_r was set
David Hook
More... about 1 month ago
BCFKS: derive scrypt keys with the encoded parallelization parameter rather than the block size, retrying the previous convention on load so a store written by an earlier release still opens, and writing p equal to r by default under org.bouncycastle.bcfks.scrypt_p_eq_r so a store written here is read by both
David Hook
More... about 1 month ago
LMS: Build the tree for the public key as the authentication path of the current one-time key, so a freshly generated key retains its first signature's path instead of rebuilding the 2^(h-5) leaves below the cached top that the build has just computed and dropped; fresh ancestors within the pinned top and the root are published to the cache as a side effect
Peter Dettman
More... about 1 month ago
LMS: Replace the private key's WeakHashMap node cache, which held every node below the persisted top on keys nothing retained, with a fixed array of the top 63 nodes plus the retained authentication path and ancestor chain of the last one-time key signed with, advanced under the key's lock, ported from bc-csharp
Peter Dettman
More... about 1 month ago
LMS: Add the RFC 9858 Appendix A test vectors to HSSTests, verifying each and regenerating the public key and signature from the RFC SEED and I for the H=5 cases
Peter Dettman
More... about 1 month ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... about 1 month ago
Added Properties.JSSE_USE_NAMED_GROUPS_ORDER for the org.bouncycastle.jsse.useNamedGroupsOrder system property, mirrored into the jdk1.4 Properties overlay, with ContextData and UseNamedGroupsOrderTest reading the name from the constant rather than a literal.
David Hook
More... about 1 month ago
The multiReleaseCheck task now loads each distributed jar together with the sibling BC jars it depends on as one class universe, so a companion jar's references into an overlaid bcprov class are checked as well as the jar's own pairings, and the root project carries the same check as multiReleaseCheckJar for arbitrary jars via -PmrJar and -PmrClasspath, a published release included, relates to github #2448.
David Hook
More... about 1 month ago
The jdk1.9 copy of the BCJSSE SSLEngineUtil now declares create(ContextData) with the same SSLEngine return type as the root copy, so the root ProvSSLContextSpi compiled against one is no longer paired at runtime with the other and SSLContext.createSSLEngine() works again on JDK 9+ with the multi-release bctls jar, with a JDK 25 test creating engines against the built jar and a new multiReleaseCheck Gradle task on every distributed jar that fails the build when a member reference does not resolve against the copy of its target a JDK would pair it with, relates to github #2448.
David Hook
More... about 1 month ago
Improve the exact-incremental reader. Allocates directly for small lengths. For larger lengths, a rope of 64KiB chunks is used until we reach the safety threshold, then the full allocation is done once.
Peter Dettman
More... about 1 month ago
Clarify PKIXNameConstraints divergence from bc-csharp
Peter Dettman
More... about 1 month ago
The pgsc module is now carried by the Maven BOM and so the generated SBOM, by the dist gathering tasks and by the OSGi scan, which picks up tls-klog as well, and the module graph and :test aggregate in the docs list it.
David Hook
More... about 1 month ago
Recorded the Ant build traps found building the r1rv86 tag in a clean tree: the empty core/src/main/resources git cannot carry, the build1-* scripts not propagating an Ant failure, the shared build directory, and using a worktree rather than checking a tag out in this clone.
David Hook
More... about 1 month ago
Removed the maintainer's name and home-directory paths from the docs/claude guidance and the bundled skills, both of which ship with the source, keeping the /opt locations the build scripts hardcode and deriving the jdk1.3 script's repo path from its own location.
David Hook
More... about 1 month ago
A tested dNSName, rfc822Name host or uniformResourceIdentifier host carrying an empty label is now refused wherever a constraint of that type is in force, rather than canonicalised into a name it is not, the single RFC 1034 root-label dot being the only empty label a name may legally carry, relates to github PR #2436.
David Hook
More... about 1 month ago
Add windows-build skill: driving the Gradle build and fast single-class JUnit loops from a Windows checkout. Bash vs PowerShell gradlew, running under one JDK, verifying fresh results (all Test tasks share the flat XML directory), daemon and timing notes
Peter Dettman
More... about 1 month ago
SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory now choose between the GOST R 34.10-2001 and GOST R 34.10-2012 key algorithm OIDs by the digestParamSet rather than by whether the publicKeyParamSet is a legacy CryptoPro parameter set, which RFC 9215 sec. 4.2 permits for 2012 keys, so a CryptoPro curve with the GOST R 34.11-2012 digest encodes under id-tc26-gost3410-12-256 rather than id-GostR3410-2001, with 256 versus 512 taken from the curve field size and an unrecognised digestParamSet rejected; the shared rule lives in the new ECGOST3410Util, gostR3411_94_TestParamSet is added to CryptoProObjectIdentifiers, PrivateKeyInfoFactory carries attributes through for ECGOST3410 keys, and GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL in both directions - a one-element SEQUENCE decodes (PrivateKeyFactory admits it) and a digest alongside 256 paramSetB/C/D is accepted on decode - while refusing an encryptionParamSet without a digestParamSet, ported from bc-csharp, relates to bc-csharp github #707.
Peter Dettman
More... about 1 month ago
Added CMS SignedData and PKIX certification path test coverage for the eighteen Composite ML-DSA parameter sets, which the CMS and cert-path signature algorithm finders already reached with no test exercising either, relates to github PR #2437.
David Hook
More... about 1 month ago