Replace Curve25519 class with X25519 Key Agreement #838
Conversation
exceptionfactory
force-pushed
the
X25519-2
branch
from
bb67caf to
aa10c7a
Compare
|
This will require a few more changes, because now the Curve25519 is no longer compatible with Java7 which is the target compilation version. I'm fine with removing support for older java versions and making the minimum version java11 from now on, but then you will also need to update the build files are part of this PR. |
|
Thanks for the feedback @hierynomus! To clarify the comment on Java 11, these changes work without issue on Java 8, so there is no need to make the minimum project version Java 11. The net effect of these changes is to use the Bouncy Castle implementation of |
|
On a related note, if you are interested in making Java 8 the minimum version in a separate PR, that might have some other benefits, but based on testing these changes with Java 8, that should not be required in this PR. |
Codecov Report
@@ Coverage Diff @@
## master #838 +/- ##
============================================
+ Coverage 64.89% 65.09% +0.19%
+ Complexity 1465 1434 -31
============================================
Files 210 209 -1
Lines 8523 8061 -462
Branches 780 752 -28
============================================
- Hits 5531 5247 -284
+ Misses 2582 2407 -175
+ Partials 410 407 -3
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
This pull request addresses an unresolved issue in the
Curve25519DHimplementation related to the use of Bouncy Castle for Curve25519 Diffie-Hellman Key Agreement as defined in RFC 8731.The existing implementation creates an instance of
ECParameterSpecbut does not use it for key agreement processing. The existing implementation also uses a ported implementation of the Curve25519 algorithm in thedjb.Curve25519class.This pull request refactors the
Curve25519DHto use the standard Java CryptographyKeyPairGeneratorandKeyAgreementinterfaces, which are instantiated in the parentDHBaseclass using the standardX25519algorithm identifier.The
KeyPairGeneratorimplementation is based on the registered Security Provider, which is Bouncy Castle in normal operation. Java 11 introduced direct support forX25519, so this implementation approach provides greater flexibility for future versions of SSHJ using the standard Java Cryptography interfaces.Changing to the standard interfaces removes the need for the ported
djb.Curve25519implementation class, and also removes direct references to Bouncy Castle classes from theCurve25519DHclass. These changes pass existing Key Exchange integration tests, and also include a unit test with basic key generation operations.