Open Hub
Open Hub

 Settings

1
I Use This!
Very High Activity

Commits : Listings

Analyzed 1 day ago. based on code collected 2 days ago.
Nov 06, 2025 — Nov 06, 2026
Commit Message Contributor Files Modified Lines Added Lines Removed Code Location Date
C509 certificates — CBOR encoding of X.509 (draft-ietf-cose-cbor-encoded-cert-20)
Gefei Li
More... 3 months ago
Merge branch 'cbor-c509' into 'main'
David Hook
More... 3 months ago
Add PGPKeyPairGenerator factory methods for OpenPGP brainpool keys
Paul Schaub
More... 3 months ago
Reject wrong-length input in AIMer key parameters, trailing data in LMSSignature, short recovered blocks in ISO9796d2Signer, and short/null DNS records in DANEEntry
David Hook
More... 3 months ago
Fix equals() throwing IllegalStateException instead of returning false on a destroyed CMCE/FrodoKEM/ML-DSA/ML-KEM/SLH-DSA private key
David Hook
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Order SET elements with a stable O(N log N) sort over encodings derived once, through a new org.bouncycastle.util.Arrays.sort wrapper, so a SET arriving in descending order no longer costs O(N^2) encodings to re-encode; the j2me tree keeps its insertion sort, memoised, since CLDC has no java.util.Arrays.
David Hook
More... 3 months ago
Encode each SET element once when sorting and carry the encodings alongside the elements, rather than re-deriving an element's DER encoding every time the insertion sort shifts it, which cost O(N^2) encodings and made a DER re-encode of a large SET seconds to minutes of CPU.
David Hook
More... 3 months ago
Ignore a local/ directory for analysis reports, plans and working notes that should not be tracked.
David Hook
More... 3 months ago
Cap the bcrypt round count taken from an encrypted OpenSSH private key's kdfoptions with the new org.bouncycastle.openssh.max_rounds property, since it drives the KDF before the key has been verified and the wire format allows CPU-months of work from a few hundred bytes.
David Hook
More... 3 months ago
Consume an unknown OER extension in bounded chunks and fail at the genuine end of input, rather than reading its attacker-declared length one byte at a time while ignoring end of stream - which burned CPU proportional to the declared length and then let the parse return normally.
David Hook
More... 3 months ago
Cover the HPKE one-shot secret export pair, which had no caller in the tree at all: sendExport and receiveExport agree across all four modes and on the export-only suite, and the exporter context separates secrets drawn from one exchange.
David Hook
More... 3 months ago
Advance the HPKE sequence number only after Seal/Open succeeds, per RFC 9180 sec. 5.2, so a rejected ciphertext no longer desynchronises the receiving context from the sender, and enforce the section's message limit instead of wrapping the counter.
David Hook
More... 3 months ago
Document the false-green trap when probing whether a call site is on a new code path: assert the injected break landed in both the source and the compiled class, and compile core and prov together with core first on the classpath.
David Hook
More... 3 months ago
Bound the PBKDF2 keyLength taken from a BCFKS keystore and a PBMAC1 protected PKCS#12 file before deriving, matching the iteration count caps beside it and stopping the keyLength * 8 conversion overflowing into a NegativeArraySizeException.
David Hook
More... 3 months ago
Terminate the PGPSecretKeyParser extended-header loop on end of input, which previously spun forever on a truncated expression and on a zero-byte stream.
David Hook
More... 3 months ago
Check end on its own in KeyBoxByteBuffer.rangeOf, since end - start overflows to a positive value for a sufficiently negative end and let a 38-byte keybox file allocate 2GB.
David Hook
More... 3 months ago
Read BMPString content through DefiniteLengthInputStream.toByteArray rather than sizing a char[] from the declared length, so a short crafted header can no longer drive a heap-sized allocation and an OutOfMemoryError out of a parse API declaring IOException.
David Hook
More... 3 months ago
SM9: keep key-exchange and KEM/decryption user keys apart, split KGC extraction into sig/enc interfaces with hid validation, rename the Sign family to Sig, spell identity out in full, and move SM9Sm3 to crypto.generators
David Hook
More... 3 months ago
Convert RuntimeException from AlgorithmParameters.init(byte[]) decode to IOException
David Hook
More... 3 months ago
Bounds check the removed leaf index in an MLS external commit's proposal list, which previously only counted its Remove proposals and passed the wire value straight to applyRemove.
David Hook
More... 3 months ago
Compute the MLS node index from a leaf index as unsigned long arithmetic and bound LeafIndex.directPath, so a wire leaf_index at or above 2^30 no longer wraps to a negative index that exhausts the heap in directPath, spins in commonAncestor, or - at exactly 2^31 - aliases node 0.
David Hook
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Add ECConstantTimeMultiplier, a fixed-window multiplier with signed-odd-digit recoding and cache-safe table lookups, and switch every EC secret-scalar point multiplication onto constant-time code via the new ECAlgorithms.multiplySecret - ECDH, ECDHC, ECMQV, ECVKO, SM2 encryption and key exchange, the ECIES and SAKKE KEMs, ECCSI, EC ElGamal and EC J-PAKE/Owl, with base-point secret sites moved to the fixed-point comb; a hardening for the ECDH scalar-multiplication findings reported by the Robusta team.
David Hook
More... 3 months ago
Size the random KSAK in ECCSI key generation by the curve order's bit length rather than the curve coefficient a's, which is 0 on the Koblitz curves and made key generation on them impossible.
David Hook
More... 3 months ago
Implement RFC 9509 — X.509 Extended Key Usage for 5G Network Functions
Gefei Li
More... 3 months ago
Merge branch 'rfc-9509-eku-5g-nfs' into 'main'
David Hook
More... 3 months ago
Merge remote-tracking branch 'origin/main'
royb
More... 3 months ago
Added a tls-klog user guide covering the two step opt-in, a reference TlsKeyLog implementation, the RFC 9850 labels reported and the peer controlled input hazards
royb
More... 3 months ago
Locate, open and close the BCJSSE default key/trust stores inside AccessController.doPrivileged, so the FilePermission for the JRE's jssecacerts/cacerts is required of the provider rather than of every protection domain on the call stack.
David Hook
More... 3 months ago