[dependabot]

Bumps com.google.crypto.tink:tink from 1.23.0 to 1.24.0.

Release notes

Sourced from com.google.crypto.tink:tink's releases.

Tink Java v1.24.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.24.0

The complete list of changes since 1.23.0 can be found here.

New Features

• APIs which depend on what algorithms are registered now have an overload taking a configuration argument. Using these overloads allows to ensure that behavior is independent of what else is linked in the binary. For example, instead of keysetHandle.getPrimitive(Aead.class), users can now write keysetHandle.getPrimitive(TinkConfig2026.get(), Aead.class). Similary for key generation and serialization of keysets.

  The following configs are available: AeadConfig2026 (which does not contain the KMS algorithms; use KmsAeadConfig2026 for those), DeterministicAeadConfig2026, HybridConfig2026, JwtConfig2026, KeyDerivationConfig2026, MacConfig2026, PrfConfig2026, SignatureConfig2026, StreamingAeadConfig2026. In addition, TinkConfig2026 contains all of the above algorithms (except the KMS algorithms). Finally, RegistryConfiguration.java is available to make previous behavior (examining the registered algorithms) explicit.

  Finally, the Configuration interface needed to implement new behavior is completely public, and users can implement it themselves.

• Added support for JWT ML-DSA signatures.

• Added support for MLDSA44-Ed25519-SHA512 and MLDSA65-Ed25519-SHA512 Composite ML-DSA algorithms.

• X-Wing HPKE is now also available on Android. In particular, it is available natively on Android 17 (or above), or otherwise on Android 12 (or above) with SDK Extensions version 22 or later.

• Added predefined HPKE parameters.

• Added the Prehash primitive interface for computing prehashes of messages, to support the prehash-and-sign paradigm (such as ML-DSA External Mu).

• Updated 'org.conscrypt:conscrypt-openjdk-uber' to version 2.7.0.

Changes

• Changed the named parameter name for SLH-DSA-SHA2-128S with Tink output prefix type from SLH_DSA_SHA2_128S_TINK to SLH_DSA_SHA2_128S for consistency with the other Tink languages.
• In SignaturePemKeysetReader, treat Base64 decoding failures like other PEM key parsing errors.
• In SignaturePemKeysetReader, continue parsing multi-key PEM bundles after encountering an unparsable key.
• In SignaturePemKeysetReader, preserve the parsed RSA public exponent when importing RSA public keys instead of hardcoding 65537 (F4).
• Fixed unchecked runtime exceptions in JwkSetConverter.toPublicKeysetHandle and SignatureJwkSetConverter.toPublicKeysetHandle when importing malformed JWK sets, ensuring they consistently throw a GeneralSecurityException.
• Validate coordinate lengths against curve field size in JwkSetConverter and SignatureJwkSetConverter.
• Fixed unchecked runtime exceptions in JsonKeysetReader.read and JsonKeysetReader.readEncrypted when reading malformed keysets, ensuring they consistently throw an IOException.
• AesGcmSiv now uses Conscrypt if it's available on the class path, even if it is not installed. Previously, a Conscrypt provider needed to be installed for it to work.
• Enforce canonical Base64url encoding in JwtFormat.strictUrlSafeDecode, preventing signature/MAC malleability from unused trailing bits.
• Fixed StreamingAeadSeekableDecryptingChannel.read to always authenticate the final ciphertext segment when reaching the end of the plaintext, ensuring valid empty plaintexts return -1 (EOF) and rejecting truncated or unauthenticated empty trailing segments with an IOException.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.24.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.24.0'
</tr></table> 

... (truncated)

Commits

• e036710 Update encrypted Maven Central Token
• 2454497 Tag tink_java version 1.24.0.
• 2b71d71 Replace usages of RegistryConfiguration, MacConfig, and PrfConfig in Tink Jav...
• 236d1d5 Replace usages of RegistryConfiguration and SignatureConfig in Tink Java sign...
• 5f5fb39 Use *Config2026 instead of RegistryConfiguration in internal and subtle tests
• 9bb6629 Use *Config2026 instead of RegistryConfiguration in parameters, signature, st...
• 20038c6 Use AeadConfig2026 in Tink Java walkthrough examples and tests
• e4c67d1 Use SignatureConfig2026 in SignaturePemKeysetReader.read()
• 3e24a7d Use AeadConfig2026 in Tink Java AEAD and cleartextkeyset examples
• 2f510a5 Explicitly pass RegistryConfiguration in Tink Java primitive wrapper tests.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud