8325448: Hybrid Public Key Encryption #18411

wangweij · 2024-03-20T20:43:04Z

Implement HPKE as defined in https://datatracker.ietf.org/doc/rfc9180/.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change requires CSR request JDK-8366437 to be approved
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issues

JDK-8325448: Hybrid Public Key Encryption (Enhancement - P3)
JDK-8366437: Hybrid Public Key Encryption (CSR)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/18411/head:pull/18411
$ git checkout pull/18411

Update a local copy of the PR:
$ git checkout pull/18411
$ git pull https://git.openjdk.org/jdk.git pull/18411/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 18411

View PR using the GUI difftool:
$ git pr show -t 18411

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/18411.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2024-03-20T20:43:30Z

👋 Welcome back weijun! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-03-20T20:44:09Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2024-03-20T20:44:41Z

@wangweij The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

bridgekeeper · 2024-05-16T01:34:59Z

@wangweij This pull request has been inactive for more than 8 weeks and will be automatically closed if another 8 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

wangweij · 2024-06-28T13:11:32Z

/csr

openjdk · 2024-06-28T13:12:53Z

@wangweij has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@wangweij please create a CSR request for issue JDK-8325448 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

bridgekeeper · 2024-08-23T14:03:13Z

@wangweij This pull request has been inactive for more than 8 weeks and will be automatically closed if another 8 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

bridgekeeper · 2024-10-18T14:20:54Z

@wangweij This pull request has been inactive for more than 16 weeks and will now be automatically closed. If you would like to continue working on this pull request in the future, feel free to reopen it! This can be done using the /open pull request command.

wangweij · 2024-11-06T18:56:16Z

/open

openjdk · 2024-11-06T18:57:14Z

@wangweij This pull request is now open

bridgekeeper · 2025-01-01T21:06:48Z

@wangweij This pull request has been inactive for more than 8 weeks and will be automatically closed if another 8 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

mlbridge · 2025-02-25T21:34:11Z

Webrevs

src/java.base/share/classes/sun/security/util/SliceableSecretKey.java

src/java.base/share/classes/javax/crypto/spec/snippet-files/PackageSnippets.java

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java

seanjmullan · 2025-08-25T18:51:07Z

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java

+ * of RFC 9180 and the
+ * <a href="https://www.iana.org/assignments/hpke/hpke.xhtml">IANA HPKE page</a>.
+ * <p>
+ * Once an {@code HPKEParameterSpec} object is created, additional methods


src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java

seanjmullan · 2025-08-27T20:00:54Z

Hi Sebastian, the API you suggested is only the KEM step, and it should be made internal inside HPKE.

At the end of the day, HPKE is still a cipher. I understand the key encapsulation message (aka, KEM ciphertext) is different from a traditional IV, but they share some key characteristics: 1) generated by the sender after initialization, 2) cryptographically random, 3) then made public, 4) has critical impact on encryption result.

To avoid some of this potential confusion, I think it could help to expand on the description of Cipher.getIV() to describe this new use case for IV, something like changing this sentence:

"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password."

to:

"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password, or in the case of HPKE (Hybrid Public Key Encryption) where IV contains the encapsulation of the KEM shared secret."

wangweij · 2025-08-28T11:55:13Z

Hi Sebastian, the API you suggested is only the KEM step, and it should be made internal inside HPKE.
At the end of the day, HPKE is still a cipher. I understand the key encapsulation message (aka, KEM ciphertext) is different from a traditional IV, but they share some key characteristics: 1) generated by the sender after initialization, 2) cryptographically random, 3) then made public, 4) has critical impact on encryption result.

To avoid some of this potential confusion, I think it could help to expand on the description of Cipher.getIV() to describe this new use case for IV, something like changing this sentence:

"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password."

to:

"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password, or in the case of HPKE (Hybrid Public Key Encryption) where IV contains the encapsulation of the KEM shared secret."

Good idea. Somehow I hesitate to update the base spec directly. Shall we put the whole paragraph into an @apiNote? A similar paragraph also appears in CipherSpi::engineGetIV.

seanjmullan · 2025-08-28T12:46:11Z

Hi Sebastian, the API you suggested is only the KEM step, and it should be made internal inside HPKE.
At the end of the day, HPKE is still a cipher. I understand the key encapsulation message (aka, KEM ciphertext) is different from a traditional IV, but they share some key characteristics: 1) generated by the sender after initialization, 2) cryptographically random, 3) then made public, 4) has critical impact on encryption result.

To avoid some of this potential confusion, I think it could help to expand on the description of Cipher.getIV() to describe this new use case for IV, something like changing this sentence:
"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password."
to:
"This is useful in the case where a random IV was created, or in the context of password-based encryption or decryption, where the IV is derived from a user-supplied password, or in the case of HPKE (Hybrid Public Key Encryption) where IV contains the encapsulation of the KEM shared secret."

Good idea. Somehow I hesitate to update the base spec directly. Shall we put the whole paragraph into an @apiNote? A similar paragraph also appears in CipherSpi::engineGetIV.

Yes, making this text an API note, which is what it really is, is a really good idea.

wangweij · 2025-09-02T17:03:35Z

New commit pushed. The with methods can no longer be used to "reset" a field to its default value, for example, calling withInfo(new byte[0]) to remove the non-default info or withAuthKey(null) to revert to mode_base.

Reasons:

Allowing a default value might hide unintended empty user input.
It's hard to manage all the fields in an HPKEParameterSpec object and reuse it back and forth.

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java

src/java.base/share/classes/com/sun/crypto/provider/DHKEM.java

src/java.base/share/classes/com/sun/crypto/provider/HPKE.java

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java

ascarpino · 2025-11-05T19:35:59Z

src/java.base/share/classes/com/sun/crypto/provider/HPKE.java

+            AlgorithmParameterSpec params, SecureRandom random)
+            throws InvalidKeyException, InvalidAlgorithmParameterException {
+        impl = new Impl(opmode);
+        if (!(key instanceof AsymmetricKey ak)) {


Is a null check needed for key and params? It appears Cipher leaves that to the SPI to accept or reject.

If key is null, you will see "InvalidKeyException: Not an asymmetric key". I assume that's also OK?

I'll deal with params, there is a similar exception but unfortunately I called params.getClass() there.

ascarpino · 2025-11-05T23:40:15Z

src/java.base/share/classes/com/sun/crypto/provider/HPKE.java

+                this.exporter_secret = exporter_secret;
+            }
+
+            SecretKey ExportKey(String algorithm, byte[] exporter_context, int L) {


Why are the methods in this class capitalized?

I like using the original function names from the RFC. If you don't like, I can modify them to Java-style.

ascarpino · 2025-11-06T01:50:44Z

src/java.base/share/classes/com/sun/crypto/provider/HPKE.java

+                // deriveData must and can be called because all info to
+                // thw builder are just byte arrays. Any KDF impl can handle this.
+                var kdf = KDF.getInstance(kdfAlg);
+                var key_schedule_context = concat(new byte[]{(byte) mode},


Is key_sechedule_context worth zero'ing?

Maybe not? psk_id does not sound like a secret thing. I understand psk is.

the fix

0cbd952

openjdk bot added the security [email protected] label Mar 20, 2024

wangweij mentioned this pull request May 15, 2024

8325513: Export method for Cipher #18409

Open

4 tasks

wangweij added 5 commits May 17, 2024 09:28

no export, params from record to class

652d63f

Merge branch 'master' into 8325448

36993a3

disabled algorithms

4419200

remove debug lines

95f658c

Merge branch 'master' into 8325448

ed9f5d0

openjdk bot added the csr Pull request needs approved CSR before integration label Jun 28, 2024

bridgekeeper bot closed this Oct 18, 2024

openjdk bot reopened this Nov 6, 2024

wangweij added 3 commits December 19, 2024 11:56

spec update

80a188a

Merge branch 'master' into 8325448

e7db8b8

no scope for td

6d4bbfa

wangweij added 2 commits February 25, 2025 16:28

Use KDF API

d77a1b2

Merge branch 'master' into 8325448

412efec

wangweij marked this pull request as ready for review February 25, 2025 21:30

openjdk bot added the rfr Pull request is ready for review label Feb 25, 2025

cleaner comments

31c3f69

seanjmullan reviewed Aug 22, 2025

View reviewed changes

8325448: Hybrid Public Key Encryption

fba0da9

seanjmullan reviewed Aug 25, 2025

View reviewed changes

address Sean's comments

b42a855

seanjmullan reviewed Aug 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java Outdated Show resolved Hide resolved

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java Outdated Show resolved Hide resolved

seanjmullan reviewed Aug 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java Outdated Show resolved Hide resolved

more spec change

4772004

seanjmullan reviewed Aug 27, 2025

View reviewed changes

src/java.base/share/classes/javax/crypto/spec/HPKEParameterSpec.java Outdated Show resolved Hide resolved

use different exception type

29cb254

wangweij added 5 commits August 28, 2025 10:04

receiver to recipient; different to specified

8dbc050

duplicated "value" words

cbce830

withMethods

d4c237f

algorithm identifier

bdd00bd

cannot reset with withMethods

cef5557

wangweij added 2 commits September 2, 2025 17:26

about transformation

a6949f5

Merge branch 'master' into 8325448

1ec31cf

ascarpino reviewed Sep 12, 2025

View reviewed changes

more key checks; some small spec change

b86797a

ascarpino reviewed Oct 3, 2025

View reviewed changes

wangweij added 3 commits October 27, 2025 17:11

Tony's comment

cca3c8d

Merge branch 'master' into 8325448

8c6cffa

merge

b511215

ascarpino reviewed Nov 7, 2025

View reviewed changes

wangweij added 2 commits November 7, 2025 18:02

check null and tests

4d5b15f

java style method names

52c4d84

8325448: Hybrid Public Key Encryption #18411

Are you sure you want to change the base?

8325448: Hybrid Public Key Encryption #18411

Conversation

wangweij commented Mar 20, 2024 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewing

Uh oh!

bridgekeeper bot commented Mar 20, 2024

Uh oh!

openjdk bot commented Mar 20, 2024

Uh oh!

openjdk bot commented Mar 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bridgekeeper bot commented May 16, 2024

Uh oh!

wangweij commented Jun 28, 2024

Uh oh!

openjdk bot commented Jun 28, 2024

Uh oh!

bridgekeeper bot commented Aug 23, 2024

Uh oh!

bridgekeeper bot commented Oct 18, 2024

Uh oh!

wangweij commented Nov 6, 2024

Uh oh!

openjdk bot commented Nov 6, 2024

Uh oh!

bridgekeeper bot commented Jan 1, 2025

Uh oh!

mlbridge bot commented Feb 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanjmullan Aug 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanjmullan commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wangweij commented Aug 28, 2025

Uh oh!

seanjmullan commented Aug 28, 2025

Uh oh!

wangweij commented Sep 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ascarpino Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

wangweij Nov 7, 2025

wangweij commented Mar 20, 2024 •

edited by openjdk bot

Loading

openjdk bot commented Mar 20, 2024 •

edited

Loading

mlbridge bot commented Feb 25, 2025 •

edited

Loading

seanjmullan commented Aug 27, 2025 •

edited

Loading