asmhatreandClaude Sonnet 5
f59c1de96d
Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01B38FGKKam5SCGgwgduVAh3
55 lines
2.7 KiB
Bash
Executable File
55 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# JEP 527: post-quantum hybrid key exchange in the JDK's default TLS 1.3 stack.
|
|
# ./scripts/tls-pq.sh -> docs/output/30-tls-groups-matrix.txt, 31-tls-clienthello-size.txt, 32-tls-opt-out.txt
|
|
set -euo pipefail
|
|
source "$(dirname "$0")/env.sh"
|
|
B="$ROOT/build/tls"; rm -rf "$B"; mkdir -p "$B"
|
|
"$JDK27/bin/javac" --release 26 -d "$B" "$ROOT"/jep-tour/src/TlsPeer.java "$ROOT"/jep-tour/src/ClientHelloSize.java
|
|
|
|
# A throwaway self-signed certificate for the loopback server; the same store is the client's trust store.
|
|
"$JDK27/bin/keytool" -genkeypair -alias demo -keyalg EC -groupname secp256r1 -dname "CN=localhost" -validity 2 \
|
|
-storetype PKCS12 -keystore "$B/ks.p12" -storepass changeit -ext san=dns:localhost >/dev/null 2>&1
|
|
STORE=(-Djavax.net.ssl.keyStore="$B/ks.p12" -Djavax.net.ssl.keyStorePassword=changeit
|
|
-Djavax.net.ssl.trustStore="$B/ks.p12" -Djavax.net.ssl.trustStorePassword=changeit)
|
|
DEBUG=(-Djavax.net.debug=ssl:handshake)
|
|
|
|
# handshake <server-jdk> <client-jdk> [extra client flag]
|
|
handshake() {
|
|
local sj="$1" cj="$2" cflag="${3:-}"; local pf="$B/port"; rm -f "$pf"
|
|
"$sj/bin/java" "${STORE[@]}" "${DEBUG[@]}" -cp "$B" TlsPeer server "$pf" > "$B/server.log" 2>&1 &
|
|
local spid=$!
|
|
for _ in $(seq 1 50); do [ -s "$pf" ] && break; sleep 0.1; done
|
|
"$cj/bin/java" $cflag "${STORE[@]}" "${DEBUG[@]}" -cp "$B" TlsPeer client "$(cat "$pf")" > "$B/client.log" 2>&1
|
|
wait "$spid"
|
|
echo "client offered : $(grep -m1 '"named groups"' "$B/client.log" | sed 's/^ *//')"
|
|
echo "server selected: $(awk '/"ServerHello"/{f=1} f&&/"named group"/{print $NF; exit}' "$B/client.log")"
|
|
grep -m1 'handshake complete' "$B/client.log"
|
|
}
|
|
|
|
{
|
|
echo "# Who talks to whom: the key-exchange group each pairing actually negotiates (TLS 1.3, loopback)"
|
|
for pair in "26 26" "27 27" "27 26" "26 27"; do
|
|
set -- $pair
|
|
cj="JDK$1"; sj="JDK$2"
|
|
echo; echo "=== client JDK $1 -> server JDK $2"
|
|
handshake "${!sj}" "${!cj}"
|
|
done
|
|
} > "$OUT/30-tls-groups-matrix.txt" 2>&1
|
|
|
|
{
|
|
echo "# Size of the first TLS record (the ClientHello) each JDK sends"
|
|
for v in 26 27; do
|
|
jdk="JDK$v"; echo; echo "=== JDK $v"
|
|
"${!jdk}/bin/java" -cp "$B" ClientHelloSize
|
|
done
|
|
echo; echo "=== JDK 27 with -Djdk.tls.namedGroups=x25519,secp256r1 (post-quantum group removed)"
|
|
"$JDK27/bin/java" -Djdk.tls.namedGroups=x25519,secp256r1 -cp "$B" ClientHelloSize
|
|
} > "$OUT/31-tls-clienthello-size.txt" 2>&1
|
|
|
|
{
|
|
echo "# Opting out on JDK 27: a client that does not offer the hybrid group"
|
|
echo; echo "=== client JDK 27 with -Djdk.tls.namedGroups=x25519,secp256r1 -> server JDK 27"
|
|
handshake "$JDK27" "$JDK27" "-Djdk.tls.namedGroups=x25519,secp256r1"
|
|
} > "$OUT/32-tls-opt-out.txt" 2>&1
|
|
cat "$OUT/30-tls-groups-matrix.txt" "$OUT/31-tls-clienthello-size.txt" "$OUT/32-tls-opt-out.txt"
|