spring-projects / spring-projects/spring-boot

Add support for TLS named groups in SslBundles

Open
#46,968 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: pending-design-work type: enhancement
Dominant language
Java
Stars
81.5k
Forks
42.7k
Avg merge
2d 4h
Merged PRs (30d)
65

Description

SslBundles provides a way to configure SslOptions that should be applied when establishing an SSL connection. Starting with Java 20, SSLParameters can now be configured with key exchange named groups names. It would be nice if these could be set on SslBundles to be applied to the different HTTP client and Servers.

In the context of PQC this would give the ability to configure Post-Quantum Hybrid Key Exchange groups for TLS 1.3.

This is described in draft JEP

Bouncy Castle has already added support for Post-Quantum Hybrid Key Exchange in their JSSE provider.
This can be seen in this sample repo

This enhancement would rely on the underlying clients and servers supporting setting SSLParameters, which I am currently evaluating to understand which already support this and which do not.

Here is an example of what setting this on the JDK client would look like:

private SSLParameters asSslParameters(SslBundle sslBundle) {
    SslOptions options = sslBundle.getOptions();
    SSLParameters parameters = new SSLParameters();
    parameters.setCipherSuites(options.getCiphers());
    parameters.setNamedGroups(options.getNamedGroups());
    parameters.setProtocols(options.getEnabledProtocols());
    return parameters;
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with core/spring-boot/src/main/java/org/springframework/boot/ssl/SslOptions.java and inspect SslBundles, then review JdkHttpClientBuilder.java around the SSLParameters setup shown in the issue. Check which HTTP clients and servers expose SSLParameters support; done means named groups can be configured through SslBundles and applied where the underlying implementation supports them.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.