feat(gax-httpjson): Add Post Quantum Cryptography (PQC) Support by default via Conscrypt by lqiu96 · Pull Request #13853 · googleapis/google-cloud-java

lqiu96 · 2026-07-21T19:58:13Z

No description provided.

gemini-code-assist

Code Review

This pull request introduces Post-Quantum Cryptography (PQC) TLS negotiation for HTTP/JSON clients by integrating Conscrypt as a security provider and adding corresponding integration tests. The reviewer feedback focuses on improving the robustness and architecture of this implementation. Specifically, the reviewer recommends removing the undesirable coupling from the core HTTP module to the transport-specific module by defining the PQC groups locally. Additionally, the reviewer suggests wrapping the Conscrypt named groups configuration in a defensive try-catch block and separating the builder creation from the build calls to prevent genuine configuration or mTLS errors from being incorrectly swallowed as Conscrypt loading failures.

lqiu96 · 2026-07-21T20:47:56Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces Post-Quantum Cryptography (PQC) TLS negotiation support for HTTP/JSON clients by registering Conscrypt as the security provider and configuring default PQC named groups. The feedback suggests utilizing lazy initialization and caching for the Conscrypt security provider in both InstantiatingHttpJsonChannelProvider and HttpTransportOptions to prevent the performance and memory overhead of instantiating a new provider on every transport creation.

gemini-code-assist · 2026-07-21T20:50:20Z

+    private static final String[] PQC_GROUPS =
+        new String[] {"X25519MLKEM768", "SecP256r1MLKEM768", "X25519"};
    private static final HttpTransportFactory INSTANCE = new DefaultHttpTransportFactory();


Prefer lazy initialization and caching for resource-intensive objects like the Conscrypt security provider. Creating a new Provider instance on every transport creation can lead to significant performance overhead and high memory usage.

We can introduce a static lazy holder class to cache the Conscrypt provider instance safely, ensuring it is only initialized once and does not cause class-loading issues if Conscrypt is not present on the classpath.

private static final String[] PQC_GROUPS = new String[] {"X25519MLKEM768", "SecP256r1MLKEM768", "X25519"}; private static final HttpTransportFactory INSTANCE = new DefaultHttpTransportFactory(); private static class ConscryptProviderHolder { private static final java.security.Provider INSTANCE = createProvider(); private static java.security.Provider createProvider() { try { return Conscrypt.newProvider(); } catch (Throwable t) { LOG.log( Level.FINE, "Conscrypt native libraries not available. Falling back to JDK TLS.", t); return null; } } }

References

Prefer lazy initialization over eager initialization for resource-intensive objects (such as CharsetEncoder) if they are not guaranteed to be used in all execution paths, to avoid unnecessary performance and memory overhead.

blakeli0 · 2026-07-22T03:17:13Z

+              }
+              try {
+                Conscrypt.setNamedGroups(socket, DEFAULT_PQC_GROUPS);
+              } catch (Throwable t) {


Are there known checked exceptions? If not, catching Exception is fine but catching Throwable might hide larger problems. e.g. Even if a version mismatch is ignored here, it might blow up in other places.

It doesn't throw any CheckExceptions. I'll change this so that it catches Exceptions instead. Online suggests the possibility of wrapped SSLSockets or proxied ones failing the Conscrypt check, but that seems to throw an Exception instead.

If there is a version mismatch of a JNI issue, that should be caught in the Conscrypt initializaiton logic and would be caught by the conscryptProvider == null check above.

blakeli0 · 2026-07-22T03:19:01Z

+   *
+   * <p>Returns {@code null} on failure so that transport creation can fall back to default JDK TLS,
+   * ensuring that setting Conscrypt as the default security provider does not cause breaking
+   * failures for customers running on environments where Conscrypt is unsupported or unavailable.


where Conscrypt is unsupported

What error would we run into?

I'm not too sure. I think it's a linkage error but i'm not too familiar with native API logic as to which error message is thrown

Do we want to catch linkage error though? Unless we know this could cause incompatible issues, I think catching Exception below makes more sense.

…qc-verification sample module

…streamline Conscrypt try-fallback

…rator in try block and remove draft Javadoc

…h blocks in GAX and Core HTTP

…pt is unavailable

…annelProviderTest

…n GAX and Core HTTP

…lProviderTest and HttpTransportOptionsTest

…t exception and restore HttpTransportOptionsTest to main

…ryptPqcConfiguratorHelper

…t classical non-PQC test case

… helper Javadocs

…ation in ITPqc

… handling

…socket configurator

…nstance

…Conscrypt log level to WARNING

…scrypt PQC fallback

…ransportUtils

…crypt Javadoc

…rHolder and comment catch block

…tProviderHolder Javadoc

…ptography

…rypt to dependencies.properties

…core-http/pom.xml

…va/pom.xml properties

…gHttpJsonChannelProviderTest

…tQuantumCryptography

…ryptography

…eserve default SSLContext

…nsport.Builder without modifying global Security providers

…t JSSE test case

…loud-java into pqc-httpjson-support

…_PQC_GROUP in header string

…Kyber768Draft00, MLKEM1024, and X25519

lqiu96 · 2026-07-24T21:24:36Z

+  public static final String[] DEFAULT_PQC_GROUPS =
+      new String[] {"X25519MLKEM768", "X25519Kyber768Draft00", "MLKEM1024", "X25519"};


@blakeli0 Update the groups as I found out these are the MKLEM groups that Conscrypt supports: https://github.com/google/conscrypt/blob/44a36308a64e3f872192baabd7c3b5819dc618a2/CAPABILITIES.md?plain=1#L94-L96

… workflow

blakeli0 · 2026-07-27T21:02:43Z

+  }
+
+  @Test
+  void testDefaultPqcGroups_containsExpectedGroups() {


This test is a duplicate of the same test in HttpJsonConscryptUtilsTest.

Removing this test. I don't think it needs to be tested. Jetski added this in for coverage

blakeli0 · 2026-07-27T21:03:48Z

+
+  @Test
+  void testDefaultPqcGroups_containsExpectedGroups() {
+    assertThat(HttpJsonConscryptUtils.DEFAULT_PQC_GROUPS)


This test would always pass if we change a value in the group. We should use String literals for assertion.

I don't think we need to test this. I'm going to remove this

blakeli0 · 2026-07-27T21:05:21Z

+      HttpJsonMetadata capturedHeaders = interceptor.metadata;
+      assertThat(capturedHeaders).isNotNull();
+
+      String negotiatedGroup = getSingleHeaderString(capturedHeaders, TLS_GROUP_HEADER);


Cool, I don't see this showcase test reference it yet though. Also I don't think we should expose a field as public just for testing.

blakeli0 · 2026-07-27T21:06:17Z

+   * </ul>
+   */
+  public static final String[] DEFAULT_PQC_GROUPS =
+      new String[] {"X25519MLKEM768", "X25519Kyber768Draft00", "MLKEM1024", "X25519"};


I see this list is different from last time I reviewed. Is there a definitive list we can reference?

#13853 (comment)

Found after additional showcase testing. Conscrypt's list of supported algos

… matching for supported groups

…r future-proof JDK 27+ compatibility

… configuration is required for future JDK 27+ compatibility

…or supported groups containment and reduce DEFAULT_PQC_GROUPS visibility

…uantumCryptography comment

sonarqubecloud · 2026-07-28T05:40:38Z

Quality Gate failed for 'gapic-generator-java-root'

Failed conditions
73.9% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

sonarqubecloud · 2026-07-28T05:42:16Z

Quality Gate failed for 'gapic-generator-java-root'

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

gemini-code-assist Bot reviewed Jul 21, 2026

View reviewed changes

lqiu96 force-pushed the pqc-httpjson-support branch from 218f3e6 to 1a08829 Compare July 21, 2026 21:54

blakeli0 reviewed Jul 22, 2026

View reviewed changes

lqiu96 added 25 commits July 22, 2026 17:30

feat(httpjson): add Conscrypt PQC support for HttpJson transports

708dad6

refactor(httpjson): restrict ITPqc to HttpJson PQC tests and remove p…

e1e6de1

…qc-verification sample module

refactor(httpjson): remove X25519Kyber768Draft00 from PQC groups and …

8bf75d3

…streamline Conscrypt try-fallback

refactor(httpjson): group setSecurityProvider and setSslSocketConfigu…

d371aa4

…rator in try block and remove draft Javadoc

docs(pqc): add detailed explanatory comments above Conscrypt try-catc…

d1ce9cd

…h blocks in GAX and Core HTTP

docs(pqc): add Level.FINE logger to HttpTransportOptions when Conscry…

086faf0

…pt is unavailable

test(httpjson): remove reflection helper from InstantiatingHttpJsonCh…

94d825b

…annelProviderTest

test(pqc): add unit tests for PQC Conscrypt transport configuration i…

5078cb9

…n GAX and Core HTTP

test(pqc): clean up reflection tests from InstantiatingHttpJsonChanne…

8d936f7

…lProviderTest and HttpTransportOptionsTest

refactor(pqc): fallback to fresh NetHttpTransport.Builder on Conscryp…

baf5769

…t exception and restore HttpTransportOptionsTest to main

refactor(showcase): streamline ITPqc transport setup and remove Consc…

afbae79

…ryptPqcConfiguratorHelper

refactor(showcase): remove isConscryptFunctional fallback and restric…

3f0bec3

…t classical non-PQC test case

refactor(showcase): address PR review comments for ITPqc.java and add…

e334f80

… helper Javadocs

docs(showcase): clarify rationale for classical named groups configur…

f17b615

…ation in ITPqc

refactor(http): decouple PQC constants and add defensive lambda error…

273a3f9

… handling

fix(http): update log level to FINE and clarify fallback message for …

46aaed3

…socket configurator

perf(http): lazily initialize and cache Conscrypt security provider i…

bc541e0

…nstance

refactor(http): use early returns in createHttpTransport and upgrade …

ee8b99d

…Conscrypt log level to WARNING

docs(http): document architectural tradeoff decision for graceful Con…

36f7601

…scrypt PQC fallback

refactor(http): centralize Conscrypt PQC transport logic in HttpJsonT…

f30f266

…ransportUtils

docs(http): update Conscrypt PQC Javadoc comments and method naming

a52c88e

refactor(http): remove duplicate DEFAULT_PQC_GROUPS and simplify Cons…

7e5b30d

…crypt Javadoc

docs(http): move environment fallback explanation to ConscryptProvide…

b310138

…rHolder and comment catch block

docs(http): clarify caching rationale vs JDK TLS fallback in Conscryp…

8e31771

…tProviderHolder Javadoc

refactor(showcase): rename ITPqc integration test to ITPostQuantumCry…

3f3fcd4

…ptography

lqiu96 requested a review from blakeli0 July 23, 2026 15:23

lqiu96 added 11 commits July 23, 2026 15:26

fix(gax-httpjson): preserve isMtls on transport builder and add consc…

3c3791d

…rypt to dependencies.properties

fix(java-core): remove unused conscrypt dependency from google-cloud-…

ddb9c45

…core-http/pom.xml

fix(gax-httpjson): add conscrypt dependency to BUILD.bazel and gax-ja…

fc99684

…va/pom.xml properties

fix(gax-httpjson): replace Mockito mocks with lambdas in Instantiatin…

aef31bb

…gHttpJsonChannelProviderTest

fix(showcase): initialize SSLContext with Conscrypt provider in ITPos…

39e81d0

…tQuantumCryptography

fix(showcase): use Conscrypt.newProvider() directly in ITPostQuantumC…

1bda19d

…ryptography

fix(showcase): resolve conflict markers in ITPostQuantumCryptography

41974ff

refactor(pom): remove redundant conscrypt.version from gax-java

5c62b5b

fix(gax-httpjson): insert Conscrypt as provider #1 in Security and pr…

ecd7e3e

…eserve default SSLContext

fix(gax-httpjson): scope Conscrypt provider exclusively to NetHttpTra…

68d88b1

…nsport.Builder without modifying global Security providers

refactor(showcase): remove global SSLContext mutation and add explici…

1789e01

…t JSSE test case

lqiu96 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 24, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 24, 2026

blakeli0 reviewed Jul 24, 2026

View reviewed changes

Comment thread .../gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/ManagedHttpJsonChannel.java

lqiu96 added 4 commits July 24, 2026 17:00

chore: Address code comments

d3b04b7

Merge branch 'pqc-httpjson-support' of github.com:googleapis/google-c…

474f5a1

…loud-java into pqc-httpjson-support

fix(showcase): update supportedGroups assertion to check for EXPECTED…

e98469b

…_PQC_GROUP in header string

feat(gax-httpjson): update DEFAULT_PQC_GROUPS to include ML-KEM-768, …

1a82a7c

…Kyber768Draft00, MLKEM1024, and X25519

lqiu96 commented Jul 24, 2026

View reviewed changes

ci: add TLS showcase server instance to dependency compatibility test…

b7ab212

… workflow

blakeli0 reviewed Jul 27, 2026

View reviewed changes

lqiu96 added 6 commits July 27, 2026 18:16

chore: Address code comments

363cc2c

test(showcase): update ITPostQuantumCryptography to assert exact list…

656ee66

… matching for supported groups

test(showcase): update non-PQC test to explicitly configure X25519 fo…

0df8266

…r future-proof JDK 27+ compatibility

docs(showcase): add detailed comments explaining why explicit non-PQC…

f399419

… configuration is required for future JDK 27+ compatibility

fix(showcase): update ITPostQuantumCryptography assertions to check f…

4d00949

…or supported groups containment and reduce DEFAULT_PQC_GROUPS visibility

docs(showcase): add Conscrypt 2.6.0 CAPABILITIES permalink to ITPostQ…

375edf8

…uantumCryptography comment

		public static final String[] DEFAULT_PQC_GROUPS =
		new String[] {"X25519MLKEM768", "X25519Kyber768Draft00", "MLKEM1024", "X25519"};

Uh oh!

Conversation

lqiu96 commented Jul 21, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lqiu96 commented Jul 21, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Quality Gate failed for 'gapic-generator-java-root'

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Quality Gate failed for 'gapic-generator-java-root'

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants