<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Hi John,
<div><br>
</div>
<div>We are working on adding supports for ML-DSA [1] in OpenJDK. Hopefully they can be added next year. We will then be able to sign and verify a JAR file using ML-DSA.</div>
<div><br>
</div>
<div>Also, we added HSS/LMS support back in JDK 21. While OpenJDK’s builtin implementation only includes the verification part, at least can you can use it to verify.</div>
<div><br>
</div>
<div>BTW, I’ve copied this to the security-dev mailing list, which is where we discuss development of security libraries and tools.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Weijun</div>
<div><br>
</div>
<div>[1] <a href="https://openjdk.org/jeps/8339010">https://openjdk.org/jeps/8339010</a></div>
<div><br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On Nov 6, 2024, at 12:13, Dallman, John <john.dallman@siemens.com> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div>Hi, folks, <br>
<br>
Now that NIST has issued its first standards for post-quantum cryptography, can I ask about plans for supporting it in OpenJDK?
<br>
<br>
The endpoint I'm looking for is the ability to sign JAR files with a standardised PQC signature algorithm and be able to validate those signatures at run-time. Is there a plan yet for which version of OpenJDK will be able to do that?
<br>
<br>
-- <br>
John Dallman<br>
<br>
Siemens Industry Software Limited<br>
DI SW PLM PE OT PC PDE<br>
Kett House, Station Road, <br>
Cambridge CB1 2JH, United Kingdom<br>
Phone: +44 (1223) 371554<br>
mailto:john.dallman@siemens.com<br>
www.sw.siemens.com<br>
<br>
Siemens Industry Software Limited registered office: Pinehurst 2, Pinehurst Road, Farnborough, Hampshire, GU14 7BF, United Kingdom. Registered in England and Wales No. 03476850.<br>
<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</body>
</html>