Open Hub
Open Hub

 Settings

1
I Use This!
Very High Activity

Commits : Listings

Analyzed about 13 hours ago. based on code collected 1 day ago.
Nov 07, 2025 — Nov 07, 2026
Commit Message Contributor Files Modified Lines Added Lines Removed Code Location Date
Add HKDF deriveKey coverage to the JDK 25 KDF provider tests, checking extract-then-expand and extract-only derived AES SecretKeys against deriveData and the RFC 8619 CMS vector
royb
More... 3 months ago
Throw the contracted UnrecoverableKeyException instead of RuntimeException("forget something!") when a BKS/UBER key entry stored as byte data cannot be recovered as a key
royb
More... 3 months ago
Throw the contracted UnrecoverableKeyException instead of RuntimeException("forget something!") when a BKS/UBER key entry stored as byte data cannot be recovered as a key
royb
More... 3 months ago
Merge remote-tracking branch 'origin/main'
royb
More... 3 months ago
Merge remote-tracking branch 'origin/main'
royb
More... 3 months ago
Guard four fixed-arity CMS/CRMF/CMP SEQUENCE decode constructors (KEKRecipientInfo, PasswordRecipientInfo, CertRequest, RevAnnContent) with a lower-bound size check, throwing IllegalArgumentException instead of leaking ArrayIndexOutOfBoundsException for a truncated SEQUENCE
royb
More... 3 months ago
Guard four fixed-arity CMS/CRMF/CMP SEQUENCE decode constructors (KEKRecipientInfo, PasswordRecipientInfo, CertRequest, RevAnnContent) with a lower-bound size check, throwing IllegalArgumentException instead of leaking ArrayIndexOutOfBoundsException for a truncated SEQUENCE
royb
More... 3 months ago
Throw IllegalStateException (not NullPointerException) when an SLH-DSA signer is used before initialisation, matching the Ed25519/HashMLDSA signer convention
royb
More... 3 months ago
Throw IllegalStateException (not NullPointerException) when an SLH-DSA signer is used before initialisation, matching the Ed25519/HashMLDSA signer convention
royb
More... 3 months ago
Reject an ML-KEM private key encoding that is neither seed- nor expanded-key-length with IllegalArgumentException, mirroring the ML-KEM public key length check, instead of silently accepting a key with a truncated implicit-rejection secret
royb
More... 3 months ago
Reject an ML-KEM private key encoding that is neither seed- nor expanded-key-length with IllegalArgumentException, mirroring the ML-KEM public key length check, instead of silently accepting a key with a truncated implicit-rejection secret
royb
More... 3 months ago
Reject an ML-DSA private key encoding that is neither seed- nor expanded-key-length with IllegalArgumentException, mirroring the ML-DSA public key length check, instead of building a silently-corrupt key or leaking an IndexOutOfBoundsException
royb
More... 3 months ago
Reject an ML-DSA private key encoding that is neither seed- nor expanded-key-length with IllegalArgumentException, mirroring the ML-DSA public key length check, instead of building a silently-corrupt key or leaking an IndexOutOfBoundsException
royb
More... 3 months ago
SM2: Fix 'random' init, refactoring
Peter Dettman
More... 3 months ago
SM2: Fix 'random' init, refactoring
Peter Dettman
More... 3 months ago
Fix the jdk1.3 test failures surfaced once the suite could actually run to completion: X509CertSelector.getNameConstraints()/setNameConstraints() no longer throw (they were unimplemented stubs breaking every PKIX candidate-certificate lookup), RFC3280CertPathUtilities avoids a SimpleDateFormat pattern character real JDK 1.3.1 rejects, OwlCurveTest/ECJPAKECurveTest/PrimesTest are guarded against a real JDK 1.3.1 BigInteger.isProbablePrime() false negative, NewAuthenticatedDataTest drops its KMAC-with-SHAKE tests (they hung the JVM), CMSTimeStampedData's jdk1.3 overlay is resynced with an already-landed NPE fix it had missed, and the build-jdk13-docker skill script now wires up JAXP tooling and bc-test-data so the test harness works at all. All 34 AllTests suites now run with 0 errors; three carry known, unrelated residual failures left for a future pass.
David Hook
More... 4 months ago
Fix the jdk1.3 test failures surfaced once the suite could actually run to completion: X509CertSelector.getNameConstraints()/setNameConstraints() no longer throw (they were unimplemented stubs breaking every PKIX candidate-certificate lookup), RFC3280CertPathUtilities avoids a SimpleDateFormat pattern character real JDK 1.3.1 rejects, OwlCurveTest/ECJPAKECurveTest/PrimesTest are guarded against a real JDK 1.3.1 BigInteger.isProbablePrime() false negative, NewAuthenticatedDataTest drops its KMAC-with-SHAKE tests (they hung the JVM), CMSTimeStampedData's jdk1.3 overlay is resynced with an already-landed NPE fix it had missed, and the build-jdk13-docker skill script now wires up JAXP tooling and bc-test-data so the test harness works at all. All 34 AllTests suites now run with 0 errors; three carry known, unrelated residual failures left for a future pass.
David Hook
More... 4 months ago
Document that BC's ML-DSA Signature.verify() returns false uniformly for a structurally malformed signature and a cryptographically wrong one, unlike the JDK's own SUN provider which throws SignatureException for the former - class-level javadoc on the JCA SignatureSpi/HashSignatureSpi and lightweight MLDSASigner/HashMLDSASigner, plus a release note, relates to github #2367.
David Hook
More... 4 months ago
Document that BC's ML-DSA Signature.verify() returns false uniformly for a structurally malformed signature and a cryptographically wrong one, unlike the JDK's own SUN provider which throws SignatureException for the former - class-level javadoc on the JCA SignatureSpi/HashSignatureSpi and lightweight MLDSASigner/HashMLDSASigner, plus a release note, relates to github #2367.
David Hook
More... 4 months ago
Add a release note for the JcePBMac1CalculatorBuilder PBKDF2 iteration-count cap (commit 882fdab53f), which shipped without one - the RFC 9579 PBMAC1 verifier was the one PBE/PBMAC1 path in the tree left uncapped, letting a small PKCS#12 file pin a CPU core pre-authentication.
David Hook
More... 4 months ago
Add a release note for the JcePBMac1CalculatorBuilder PBKDF2 iteration-count cap (commit 0ab15c2b41), which shipped without one - the RFC 9579 PBMAC1 verifier was the one PBE/PBMAC1 path in the tree left uncapped, letting a small PKCS#12 file pin a CPU core pre-authentication.
David Hook
More... 4 months ago
Resync the jdk1.3 cert-path overlays (mirroring the jdk1.4 sync) and fix the resulting build-lw/build-pkix/build-pg/build-test rot: regenerate PKIXCertPathValidatorSpi/CertPathValidatorUtilities/RFC3280CertPathUtilities/x509 CertPathValidatorUtilities against current base (ReasonsMask rename, PKIXPolicyNode/PKIXPolicyTreeUtil extraction, dropping the unused Ext*Exception classes), regenerate stale core/pg test overlays from base (CipherTest, RomulusTest, RSABlindSignatureTest, ArmoredOutputStream's String.split call sites, StreamUtil's missing writeSeconds/readSeconds), fix jdk1.3 field-hiding compile errors (explicit this. qualifiers in JceCMSContentEncryptorBuilder and BcPGPKeyPairGeneratorProvider), and add/sync jdk1.3-overlay AllTests.java suite files (cms, pkcs, pkix, i18n, jce/provider, mail/smime) so they stop referencing test classes ant/jdk13.xml now excludes for post-1.3 JDK APIs. Also mirror the build-jdk13-docker skill's ORO_JAR pattern to mount an ant TrAX Xalan (real JDK 1.3.1 predates JAXP, so ant's own <junitreport> XSLT step and the forked <junit> XML formatter both need an external Xerces/Xalan) and to mount bc-test-data into the container, since build-test now compiles 100% cleanly across the whole jdk1.3 distribution.
David Hook
More... 4 months ago
Resync the jdk1.3 cert-path overlays (mirroring the jdk1.4 sync) and fix the resulting build-lw/build-pkix/build-pg/build-test rot: regenerate PKIXCertPathValidatorSpi/CertPathValidatorUtilities/RFC3280CertPathUtilities/x509 CertPathValidatorUtilities against current base (ReasonsMask rename, PKIXPolicyNode/PKIXPolicyTreeUtil extraction, dropping the unused Ext*Exception classes), regenerate stale core/pg test overlays from base (CipherTest, RomulusTest, RSABlindSignatureTest, ArmoredOutputStream's String.split call sites, StreamUtil's missing writeSeconds/readSeconds), fix jdk1.3 field-hiding compile errors (explicit this. qualifiers in JceCMSContentEncryptorBuilder and BcPGPKeyPairGeneratorProvider), and add/sync jdk1.3-overlay AllTests.java suite files (cms, pkcs, pkix, i18n, jce/provider, mail/smime) so they stop referencing test classes ant/jdk13.xml now excludes for post-1.3 JDK APIs. Also mirror the build-jdk13-docker skill's ORO_JAR pattern to mount an ant TrAX Xalan (real JDK 1.3.1 predates JAXP, so ant's own <junitreport> XSLT step and the forked <junit> XML formatter both need an external Xerces/Xalan) and to mount bc-test-data into the container, since build-test now compiles 100% cleanly across the whole jdk1.3 distribution.
David Hook
More... 4 months ago
Compare MLS leaf_index as unsigned in GroupKeySet.hasLeaf and Group.validateRemove, since a signed comparison let an out-of-range sender pass the membership check and drive NodeIndex.parent() into an unbounded cycle - a remotely triggerable DoS against any group member.
David Hook
More... 4 months ago
Compare MLS leaf_index as unsigned in GroupKeySet.hasLeaf and Group.validateRemove, since a signed comparison let an out-of-range sender pass the membership check and drive NodeIndex.parent() into an unbounded cycle - a remotely triggerable DoS against any group member.
David Hook
More... 4 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 4 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 4 months ago
added destroyed checks on getEncoded() for PrivateKeys, removed use of deprecated methods
David Hook
More... 4 months ago
added destroyed checks on getEncoded() for PrivateKeys, removed use of deprecated methods
David Hook
More... 4 months ago
Resync the jdk1.4 JcaContentSignerBuilder overlay with base, restoring the FixedLengthContentSigner/ExtendedContentSigner wrapping it had predated entirely - CMS SignerInfoGenerator.getPredictedEncodedLength could never return a length prediction on the jdk1.4 build for any algorithm as a result, surfacing as NewSignedDataTest.testEd448PredictedEncodedLength. Genuine 1.4 adaptations kept: PSS digest names are derived from the signature algorithm string rather than PSSParameterSpec.getDigestAlgorithm()/getMGFParameters()/getTrailerField() or MGF1ParameterSpec, none of which exist on JRE 1.4; the LMS-only constructor and the real-CompositePrivateKey/buildComposite() path are dropped, since org.bouncycastle.pqc.crypto.lms and composite JCE support are both excluded from the jdk1.4 distribution.
David Hook
More... 4 months ago