Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

0.2.25 changes #797

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

0.2.25 changes #797

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
37e9fa0
Add support for mlkem768x25519-sha256, mlkem768nistp256-sha256 & mlke…
norrisjeremy Mar 20, 2025
48ef7d3
Stop abusing the packet buffer for signature verification.
norrisjeremy Mar 21, 2025
c985047
Fix intermittent KEX errors with hybrid PQ/EC algorithms: the EC shar…
norrisjeremy Mar 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
with:
distribution: 'zulu'
java-version: '21'
java-version: '24'
check-latest: true
cache: 'maven'

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/coverity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
with:
distribution: 'zulu'
java-version: '21'
java-version: '24'
check-latest: true
cache: 'maven'
- uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 # v1.8.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/javadoc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
with:
distribution: 'zulu'
java-version: '21'
java-version: '24'
check-latest: true
- name: Build Javadoc
run: ./mvnw -B -V -e javadoc:javadoc
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
with:
distribution: 'zulu'
java-version: '21'
java-version: '24'
check-latest: true
- name: Build with Maven
run: ./mvnw -B -V -e verify -DskipTests=true -DskipITs=true
Expand All @@ -47,7 +47,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
java: ['8', '11', '17', '21', '23']
java: ['8', '11', '17', '21', '24']
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand Down
2 changes: 1 addition & 1 deletion .sdkmanrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Enable auto-env through the sdkman_auto_env config
# Add key=value pairs of SDKs to use below
java=21.0.4-tem
java=24-tem
maven=3.9.9
26 changes: 22 additions & 4 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,7 @@
<configuration>
<rules>
<requireJavaVersion>
<version>17</version>
<version>24</version>
</requireJavaVersion>
<dependencyConvergence />
<banDuplicatePomDependencyVersions />
Expand Down Expand Up @@ -402,6 +402,19 @@
<release>16</release>
</configuration>
</execution>
<execution>
<id>default-compile-24</id>
<goals>
<goal>compile</goal>
</goals>
<configuration>
<compileSourceRoots>
<compileSourceRoot>${project.basedir}/src/main/java24</compileSourceRoot>
</compileSourceRoots>
<multiReleaseOutput>true</multiReleaseOutput>
<release>24</release>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
Expand Down Expand Up @@ -529,7 +542,7 @@
<doclint>none</doclint>
<subpackages>com.jcraft.jsch</subpackages>
<excludePackageNames>com.jcraft.jsch.*</excludePackageNames>
<sourcepath>${project.build.sourceDirectory}:${project.build.directory}/generated-sources/java-templates:${project.basedir}/src/main/java9:${project.basedir}/src/main/java10:${project.basedir}/src/main/java11:${project.basedir}/src/main/java15:${project.basedir}/src/main/java16</sourcepath>
<sourcepath>${project.build.sourceDirectory}:${project.build.directory}/generated-sources/java-templates:${project.basedir}/src/main/java9:${project.basedir}/src/main/java10:${project.basedir}/src/main/java11:${project.basedir}/src/main/java15:${project.basedir}/src/main/java16:${project.basedir}/src/main/java24</sourcepath>
</configuration>
<executions>
<execution>
Expand Down Expand Up @@ -608,6 +621,7 @@
<sourceDirectory>${project.basedir}/src/main/java11</sourceDirectory>
<sourceDirectory>${project.basedir}/src/main/java15</sourceDirectory>
<sourceDirectory>${project.basedir}/src/main/java16</sourceDirectory>
<sourceDirectory>${project.basedir}/src/main/java24</sourceDirectory>
<sourceDirectory>${project.basedir}/src/main/java-templates</sourceDirectory>
</sourceDirectories>
</configuration>
Expand All @@ -628,6 +642,7 @@
<directory>${project.basedir}/src/main/java11</directory>
<directory>${project.basedir}/src/main/java15</directory>
<directory>${project.basedir}/src/main/java16</directory>
<directory>${project.basedir}/src/main/java24</directory>
<directory>${project.basedir}/src/main/java-templates</directory>
</directories>
</configuration>
Expand All @@ -637,6 +652,8 @@
<artifactId>jacoco-maven-plugin</artifactId>
<version>0.8.12</version>
<configuration>
<!-- This should be removed when Jacoco adds Java 24 support -->
<skip>true</skip>
<excludes>
<exclude>com/jcraft/jsch/JavaVersion.class</exclude>
<exclude>com/jcraft/jsch/JplLogger.class</exclude>
Expand Down Expand Up @@ -836,15 +853,16 @@
<profile>
<id>forbiddenapis</id>
<activation>
<jdk>[16,)</jdk>
<jdk>[24,)</jdk>
</activation>
<build>
<plugins>
<plugin>
<groupId>de.thetaphi</groupId>
<artifactId>forbiddenapis</artifactId>
<configuration>
<releaseVersion>16</releaseVersion>
<!-- This should be bumped to 24 when forbiddenapis catches up -->
<releaseVersion>23</releaseVersion>
</configuration>
<executions>
<execution>
Expand Down
27 changes: 15 additions & 12 deletions src/main/java/com/jcraft/jsch/DHECN.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ public boolean next(Buffer _buf) throws Exception {
return false;
}

K = encodeAsMPInt(normalize(ecdh.getSecret(r_s[0], r_s[1])));
K = encodeAsMPInt(normalize(ecdh.getSecret(r_s[0], r_s[1])), true);

byte[] sig_of_H = _buf.getString();

Expand All @@ -150,18 +150,21 @@ public boolean next(Buffer _buf) throws Exception {

// This value is called the exchange hash, and it is used to authenti-
// cate the key exchange.
buf.reset();
buf.putString(V_C);
buf.putString(V_S);
buf.putString(I_C);
buf.putString(I_S);
buf.putString(K_S);
buf.putString(Q_C);
buf.putString(Q_S);
byte[] foo = new byte[buf.getLength()];
buf.getByte(foo);

byte[] foo = encodeAsString(V_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(V_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(K_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(Q_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(Q_S, false);
sha.update(foo, 0, foo.length);

sha.update(K, 0, K.length);
H = sha.digest();

Expand Down
29 changes: 16 additions & 13 deletions src/main/java/com/jcraft/jsch/DHECNKEM.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,12 +164,12 @@ public boolean next(Buffer _buf) throws Exception {
Util.bzero(tmp);
}
try {
tmp = normalize(ecdh.getSecret(r_s[0], r_s[1]));
tmp = ecdh.getSecret(r_s[0], r_s[1]);
sha.update(tmp, 0, tmp.length);
} finally {
Util.bzero(tmp);
}
K = encodeAsString(sha.digest());
K = encodeAsString(sha.digest(), true);

byte[] sig_of_H = _buf.getString();

Expand All @@ -196,18 +196,21 @@ public boolean next(Buffer _buf) throws Exception {
// string using the process described in Section 5 of [RFC4251] and is
// then fed along with other data in H to the key exchange method's HASH
// function to generate encryption keys.
buf.reset();
buf.putString(V_C);
buf.putString(V_S);
buf.putString(I_C);
buf.putString(I_S);
buf.putString(K_S);
buf.putString(C_INIT);
buf.putString(S_REPLY);
byte[] foo = new byte[buf.getLength()];
buf.getByte(foo);

byte[] foo = encodeAsString(V_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(V_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(K_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(C_INIT, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(S_REPLY, false);
sha.update(foo, 0, foo.length);

sha.update(K, 0, K.length);
H = sha.digest();

Expand Down
44 changes: 25 additions & 19 deletions src/main/java/com/jcraft/jsch/DHGEX.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ public boolean next(Buffer _buf) throws Exception {

dh.checkRange();

K = encodeAsMPInt(normalize(dh.getK()));
K = encodeAsMPInt(normalize(dh.getK()), true);

// The hash H is computed as the HASH hash of the concatenation of the
// following:
Expand All @@ -200,26 +200,32 @@ public boolean next(Buffer _buf) throws Exception {
// mpint K, the shared secret
// This value is called the exchange hash, and it is used to authenti-
// cate the key exchange.

buf.reset();
buf.putString(V_C);
buf.putString(V_S);
buf.putString(I_C);
buf.putString(I_S);
buf.putString(K_S);
buf.putInt(min);
buf.putInt(preferred);
buf.putInt(max);
buf.putMPInt(p);
buf.putMPInt(g);
buf.putMPInt(e);
buf.putMPInt(f);

byte[] foo = new byte[buf.getLength()];
buf.getByte(foo);
byte[] foo = encodeAsString(V_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(V_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(K_S, false);
sha.update(foo, 0, foo.length);
foo = encodeInt(min);
sha.update(foo, 0, foo.length);
foo = encodeInt(preferred);
sha.update(foo, 0, foo.length);
foo = encodeInt(max);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(p, false);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(g, false);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(e, false);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(f, false);
sha.update(foo, 0, foo.length);
sha.update(K, 0, K.length);

sha.update(K, 0, K.length);
H = sha.digest();

// System.err.print("H -> "); dump(H, 0, H.length);
Expand Down
27 changes: 15 additions & 12 deletions src/main/java/com/jcraft/jsch/DHGN.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ public boolean next(Buffer _buf) throws Exception {

dh.checkRange();

K = encodeAsMPInt(normalize(dh.getK()));
K = encodeAsMPInt(normalize(dh.getK()), true);

// The hash H is computed as the HASH hash of the concatenation of the
// following:
Expand All @@ -148,18 +148,21 @@ public boolean next(Buffer _buf) throws Exception {
// mpint K, the shared secret
// This value is called the exchange hash, and it is used to authenti-
// cate the key exchange.
buf.reset();
buf.putString(V_C);
buf.putString(V_S);
buf.putString(I_C);
buf.putString(I_S);
buf.putString(K_S);
buf.putMPInt(e);
buf.putMPInt(f);
byte[] foo = new byte[buf.getLength()];
buf.getByte(foo);

byte[] foo = encodeAsString(V_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(V_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(K_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(e, false);
sha.update(foo, 0, foo.length);
foo = encodeAsMPInt(f, false);
sha.update(foo, 0, foo.length);

sha.update(K, 0, K.length);
H = sha.digest();
// System.err.print("H -> "); //dump(H, 0, H.length);
Expand Down
27 changes: 15 additions & 12 deletions src/main/java/com/jcraft/jsch/DHXEC.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ public boolean next(Buffer _buf) throws Exception {
return false;
}

K = encodeAsMPInt(normalize(xdh.getSecret(Q_S)));
K = encodeAsMPInt(normalize(xdh.getSecret(Q_S)), true);

byte[] sig_of_H = _buf.getString();

Expand Down Expand Up @@ -162,18 +162,21 @@ public boolean next(Buffer _buf) throws Exception {
// of [RFC4251], and the resulting bytes are fed as described in
// [RFC4253] to the key exchange method's hash function to generate
// encryption keys.
buf.reset();
buf.putString(V_C);
buf.putString(V_S);
buf.putString(I_C);
buf.putString(I_S);
buf.putString(K_S);
buf.putString(Q_C);
buf.putString(Q_S);
byte[] foo = new byte[buf.getLength()];
buf.getByte(foo);

byte[] foo = encodeAsString(V_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(V_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(I_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(K_S, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(Q_C, false);
sha.update(foo, 0, foo.length);
foo = encodeAsString(Q_S, false);
sha.update(foo, 0, foo.length);

sha.update(K, 0, K.length);
H = sha.digest();

Expand Down
Loading