jdk 8298390: Implementing ML-KEM key encapsulation mechanism

Java implementation of ML-KEM, the FIPS 203 post-quantum KEM scheme. Depends on https://github.com/openjdk/jdk/pull/21167

Progress

[ ] Change must be properly reviewed (1 review required, with at least 1 Reviewer)
[x] Change must not contain extraneous whitespace
[x] Commit message must refer to an issue
[ ] Change requires CSR request JDK-8342630 to be approved

Issues

JDK-8298390: Implementing ML-KEM key encapsulation mechanism (Enhancement - P3)
JDK-8342630: Implementing ML-KEM key encapsulation mechanism (CSR)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/21478/head:pull/21478
$ git checkout pull/21478

Update a local copy of the PR:
$ git checkout pull/21478
$ git pull https://git.openjdk.org/jdk.git pull/21478/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 21478

View PR using the GUI difftool:
$ git pr show -t 21478

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/21478.diff

Webrev

Link to Webrev Comment

Oct 11 '24 20:10 blperez01

:wave: Welcome back bperez! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

Oct 11 '24 20:10 bridgekeeper[bot]

@blperez01 This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8298390: Implement JEP 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism

Co-authored-by: Ferenc Rakoczi <[email protected]>
Reviewed-by: valeriep

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 225 new commits pushed to the master branch:

6d3becb486ab38c9c2d2a6fbc428bf794375317c: 8344861: Disable CheckJNICalls in tests until JDK-8344802 is fixed
15dbb6a38064d4779a44e584ae67ba26885c8436: 8344219: Remove calls to SecurityManager and doPrivileged in java.net.SocksSocketImpl after JEP 486 integration
9769ee86978584a65703712c1a845fe4f5fffe29: 8344652: Remove access control context text from SSLEngine and SSLSession APIs
82c3612d775840aa4b851a29b8ee3337950d5aeb: 8344830: [BACKOUT] JDK-8341334: CDS: Parallel relocation
64e4aa21a42688f8b2095a609e20f05af7672ca4: 8339916: AIOOBE due to Math.abs(Integer.MIN_VALUE) in tests
bf374c33f5cd5048cabe151050fada773b7d9458: 8343453: Modernize FloatingDecimal tests
847f65c14a8fea3d5e2ee9d920c458b8923da3b4: 8344844: ciReplay tests fail with -XX:+UseCompactObjectHeaders because CDS is disabled since JDK-8341553
8903854e01d2912218c4ea6973f0a36fd20167c7: 8344718: Test runtime/cds/appcds/jigsaw/addmods/AddmodsOption.java fails on Linuxppc64le after JDK-8344239
a07b72bfcfa603453ea042e89adeb9dcec8bf63a: 8344346: java/net/httpclient/ShutdownNow.java fails with java.lang.AssertionError: client was still running, but exited after further delay: timeout should be adjusted
2ea0364b6e3f10977f7b607d239c29ee616a8f7c: 8343893: Test jdk/jfr/event/runtime/TestNativeMemoryUsageEvents.java failed: heap should have grown and NMT should show that: expected 0 > 0
... and 215 more: https://git.openjdk.org/jdk/compare/5e01c40b19a5bf4d0266747ca73aca4193799d97...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

Oct 11 '24 20:10 openjdk[bot]

@blperez01 The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

Oct 11 '24 20:10 openjdk[bot]

Webrevs

Oct 11 '24 20:10 mlbridge[bot]

this PR shall link to JDK-8298390 Implementing ML-KEM key encapsulation mechanism. Not JEP task [JDK-8339009]

Oct 15 '24 14:10 YouliangGuo

Please implement the key checks at the beginnings of sections 7.2 and 7.3 of FIPS 203 in implCheckPublicKey and implCheckPrivateKey so it can detected earlier in newEcapsulator and newDecapsulator.

The current isValidDecapsulationKey does not include the hash check.

Nov 04 '24 18:11 wangweij

Note the bot warning about title mismatch... This should be fixed.

Nov 13 '24 02:11 valeriepeng

this PR shall link to JDK-8298390 Implementing ML-KEM key encapsulation mechanism. Not JEP task [JDK-8339009]

fixed

Nov 15 '24 17:11 YouliangGuo

Please implement the key checks at the beginnings of sections 7.2 and 7.3 of FIPS 203 in implCheckPublicKey and implCheckPrivateKey so it can detected earlier in newEcapsulator and newDecapsulator.

The current isValidDecapsulationKey does not include the hash check.

This has been fixed and now the checks happen in checkPublicKey and checkPrivateKey

Nov 15 '24 17:11 blperez01

Note the bot warning about "extraneous white spaces"...

Nov 20 '24 22:11 valeriepeng

@blperez01 ferakocz was not found in the census.

Syntax: /contributor (add|remove) [@user | openjdk-user | Full Name <email@address>]. For example:

/contributor add @openjdk-bot
/contributor add duke
/contributor add J. Duke <[email protected]>

User names can only be used for users in the census associated with this repository. For other contributors you need to supply the full name and email address.

Nov 22 '24 15:11 openjdk[bot]

/contributor add [email protected]

Nov 22 '24 15:11 blperez01

@blperez01 [email protected] is not a valid name and email string.

Syntax: /contributor (add|remove) [@user | openjdk-user | Full Name <email@address>]. For example:

/contributor add @openjdk-bot
/contributor add duke
/contributor add J. Duke <[email protected]>

User names can only be used for users in the census associated with this repository. For other contributors you need to supply the full name and email address.

Nov 22 '24 15:11 openjdk[bot]

/contributor add Ferenc Rakoczi [email protected]

Nov 22 '24 15:11 blperez01

@blperez01 Contributor Ferenc Rakoczi <[email protected]> successfully added.

Nov 22 '24 15:11 openjdk[bot]

/integrate

Nov 22 '24 16:11 blperez01

Going to push as commit 13987b4244614d594dc8f94c288eddb6239a066f. Since your change was applied there have been 225 commits pushed to the master branch:

6d3becb486ab38c9c2d2a6fbc428bf794375317c: 8344861: Disable CheckJNICalls in tests until JDK-8344802 is fixed
15dbb6a38064d4779a44e584ae67ba26885c8436: 8344219: Remove calls to SecurityManager and doPrivileged in java.net.SocksSocketImpl after JEP 486 integration
9769ee86978584a65703712c1a845fe4f5fffe29: 8344652: Remove access control context text from SSLEngine and SSLSession APIs
82c3612d775840aa4b851a29b8ee3337950d5aeb: 8344830: [BACKOUT] JDK-8341334: CDS: Parallel relocation
64e4aa21a42688f8b2095a609e20f05af7672ca4: 8339916: AIOOBE due to Math.abs(Integer.MIN_VALUE) in tests
bf374c33f5cd5048cabe151050fada773b7d9458: 8343453: Modernize FloatingDecimal tests
847f65c14a8fea3d5e2ee9d920c458b8923da3b4: 8344844: ciReplay tests fail with -XX:+UseCompactObjectHeaders because CDS is disabled since JDK-8341553
8903854e01d2912218c4ea6973f0a36fd20167c7: 8344718: Test runtime/cds/appcds/jigsaw/addmods/AddmodsOption.java fails on Linuxppc64le after JDK-8344239
a07b72bfcfa603453ea042e89adeb9dcec8bf63a: 8344346: java/net/httpclient/ShutdownNow.java fails with java.lang.AssertionError: client was still running, but exited after further delay: timeout should be adjusted
2ea0364b6e3f10977f7b607d239c29ee616a8f7c: 8343893: Test jdk/jfr/event/runtime/TestNativeMemoryUsageEvents.java failed: heap should have grown and NMT should show that: expected 0 > 0
... and 215 more: https://git.openjdk.org/jdk/compare/5e01c40b19a5bf4d0266747ca73aca4193799d97...master

Your commit was automatically rebased without conflicts.

Nov 22 '24 16:11 openjdk[bot]

@blperez01 Pushed as commit 13987b4244614d594dc8f94c288eddb6239a066f.

:bulb: You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Nov 22 '24 16:11 openjdk[bot]