guard minimum length in sm2 decrypt and gost/dstu/desede/rc2 unwrap - #2359

Open

rootvector2 wants to merge 4084 commits into

rootvector2:wrap-engine-min-length-guard

This pull request is big! We're only showing the most recent 250 commits

Commits on Jun 24, 2026

Commits on Jun 25, 2026

minor reformating.
dghgit
committed
Allow CMS recipients to restrict accepted content-encryption algorithms, refusing others with CMSAlgorithmNotAllowedException
dghgit
committed
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
dghgit
committed
Fix intermittent NTRU+ KEM decapsulation failure: use R mod q in the multiply-add
gefeili
committed
Guard five fixed-arity CMP/CRMF/CMS SEQUENCE decode constructors (ProtectedPart, AttributeTypeAndValue, POPOSigningKeyInput, IssuerAndSerialNumber, OriginatorPublicKey) with a lower-bound size check
royb
committed
Reject a truncated composite-signature private key shorter than the 32-byte ML-DSA seed with IOException, not an IllegalArgumentException from Arrays.copyOfRange
royb
committed
Reject negative-length and malformed-hex canonical S-expression content with a clean IOException in SExpression.parseExpression
royb
committed
Bound the attacker-controlled element count in MLSInputStream.readArray against the bytes remaining before allocating, matching the readOpaque/readAll guard
royb
committed
Fix javadoc
peterdettman
committed
Encode directly
peterdettman
committed

Commits on Jun 26, 2026

Commits on Jun 27, 2026

Commits on Jun 28, 2026

AIMer

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'kpqc-aimer' into 'main'
Administrator
committed
ElGamalEngine: validate ciphertext components on decryption (small-subgroup confinement)

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'elgamal-peer-value-validation' into 'main'
Administrator
committed
Fix `PKIXCertPathReviewer.getPolicyTree()` always returning `null`

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'pkix-getpolicytree-fix' into 'main'
Administrator
committed
Reject empty GeneralSubtrees/GeneralSubtree sequences in X.509 NameConstraints per RFC 5280 sec. 4.2.1.10, relates to github #2331.
dghgit
committed
KCCM: Decryption input length guard
peterdettman
committed
RFC 8702 — SHAKE in CMS: KMAC-with-SHAKE support

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'rfc-8702-shake-cms' into 'main'
Administrator
committed
KCCM/KGCM: Improve parameter type and reuse checks
peterdettman
committed
Enforce the RFC 9106 Argon2 memory-size-exponent floor at key derivation

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'argon2-memory-exponent-floor' into 'main'
Administrator
committed
GF256AES: Optimize mul, sqr methods
peterdettman
committed
Refactor ElGamalEngine
peterdettman
committed

Commits on Jun 29, 2026

Commits on Jun 30, 2026

Merge branch 'legacy-builds' into 'main'
ligefeiBouncycastle
committed
Correct MessageDigestUtils digest name for the RIPEMD-256 OID
gefeili
committed
Merge branch 'main' into legacy-properties-overlay-sync
gefeili
committed
build-provider + build-libraries green
gefeili
committed
Pass java 1.4 test package.
gefeili
committed
Merge branch 'messagedigestutils-ripemd256-name-fix' into 'main'
Administrator
committed
Bound the legacy PBES1 / PBKDF1 iteration count in the pkix PBE decryptor builders
gefeili
committed
Merge remote-tracking branch 'origin/main' into pbes1-pbkdf1-operator-iteration-cap
gefeili
committed
Add comment
peterdettman
committed
Cap the CMS PasswordRecipient PBKDF2 iteration count (CPU-DoS guard)

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'claude/serene-bouman-77ade5' into 'main'
Administrator
committed
#33+#34+#37 bug fix
gefeili
committed
Merge branch 'main' into openssl-pem-parse-ioexception
gefeili
committed
Use a constant-time MAC compare in the CMSAuthenticatedDataParser javadoc example
gefeili
committed
Wrap RuntimeException from the PKCS12 engineLoad MAC-data parse as IOException
gefeili
committed
Wrap RuntimeException from the CMSSignedData parse as CMSException
gefeili
committed
Wrap RuntimeException from the CMSSignedData parse as CMSException
gefeili
committed
Reject a top-level SECRET_SUBKEY packet in PGPObjectFactory.nextObject() with IOException (parser robustness)

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'pg-objectfactory-secret-subkey-ioexception' into 'main'
Administrator
committed
Surface a malformed IssuingDistributionPoint extension from X509CRLHolder(byte[] / InputStream) as IOException instead of leaking an IllegalArgumentException (parser robustness)

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'x509crlholder-idp-parse-ioexception' into 'main'
Administrator
committed
Cap the BKS keystore load iteration count to prevent a pre-integrity-check CPU-DoS

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'bks-keystore-iteration-cap' into 'main'
Administrator
committed
Cap the PKCS#12-PBE iteration count in the pkix operator / OpenSSL PKCS#8 layer (CPU-DoS guard)

ligefeiBouncycastle
authored and
Administrator
committed
Merge branch 'pkcs12-pbe-operator-iteration-cap' into 'main'
Administrator
committed

Commits on Jul 1, 2026

Commits on Jul 2, 2026

Commits on Jul 3, 2026

Commits on Jul 4, 2026

Commits on Jul 5, 2026

Reject a key whose tree digest is outside the named XMSS/XMSS^MT signer family with InvalidKeyException, keeping the generic and pre-hash signers key-driven, relates to github #2176.
dghgit
committed

Commits on Jul 6, 2026

Commits on Jul 7, 2026

Commits on Jul 8, 2026

Commits on Jul 9, 2026

Commits on Jul 10, 2026

Commits on Jul 11, 2026

Commits on Jul 12, 2026