Post-Quantum TLS with Apache Camel

This repository contains three examples demonstrating Post-Quantum Cryptography (PQC) TLS 1.3 handshakes with Apache Camel, using the X25519MLKEM768 hybrid key exchange.

X25519MLKEM768 combines classical X25519 elliptic curve Diffie-Hellman with ML-KEM-768, a post-quantum lattice-based key encapsulation mechanism (NIST FIPS 203). Both algorithms run together, so security is maintained even if one is broken.

Examples

All three examples are configured entirely through camel.ssl.* properties and perform a self-contained TLS 1.3 handshake using X25519MLKEM768 for post-quantum key exchange, verified at startup and available on demand via REST endpoints.

How They Differ

JDK 27 Native (pqc-ssl-context)

Uses the JDK's built-in SunJSSE provider, which gains PQC TLS support through JEP 527 in JDK 27.

• PQC configured via camel.ssl.namedGroups=X25519MLKEM768,x25519
• Self-signed certificate generated automatically (camel.ssl.selfSigned=true)
• REST endpoints served over HTTPS on port 8443
• Named groups set through SSLParameters.setNamedGroups() (standard JDK API)

JDK 24 with BouncyCastle (pqc-kem-jdk24)

Uses BouncyCastle's JSSE provider (BCJSSE) to bring PQC TLS support to JDK 24. While JDK 24 includes native ML-KEM as a standalone crypto primitive (JEP 496), it does not expose PQC named groups in its TLS stack. BCJSSE bridges that gap.

• PQC configured via camel.ssl.provider=BCJSSE and camel.ssl.namedGroups=X25519MLKEM768,secp256r1
• Self-signed certificate generated automatically (camel.ssl.selfSigned=true)
• REST endpoints served over HTTPS on port 8443
• Additional /api/verify-kem endpoint demonstrates JDK 24's native javax.crypto.KEM API with cross-provider interop tests
• Requires a bootstrap class to register BouncyCastle providers

JDK 21 with BouncyCastle (pqc-ssl-context-jdk21)

Uses BouncyCastle's JSSE provider (BCJSSE) to bring PQC TLS support to JDK 21, without waiting for JDK 27.

• PQC configured via camel.ssl.provider=BCJSSE and camel.ssl.namedGroups=X25519MLKEM768,secp256r1
• Self-signed certificate generated automatically (camel.ssl.selfSigned=true)
• REST endpoints served over HTTPS on port 8443
• Requires a bootstrap class to register BouncyCastle providers and remove ECDH from jdk.tls.disabledAlgorithms

Side-by-Side Comparison

Prerequisites

• Maven 3.9+
• Apache Camel 4.19.0-SNAPSHOT (or later) installed in local Maven repository
• JDK 27 EA for the native example, JDK 24 for the JDK 24 example, or JDK 21+ for the JDK 21 example

Quick Start

JDK 27 example

cd pqc-ssl-context
sdk use java 27.ea.11-open
mvn clean compile exec:exec
curl -k https://localhost:8443/api/verify-pqc

JDK 24 example

cd pqc-kem-jdk24
sdk use java 24.0.1-tem
mvn clean compile exec:exec
curl -k https://localhost:8443/api/verify-pqc
curl -k https://localhost:8443/api/verify-kem

JDK 21 example

cd pqc-ssl-context-jdk21
sdk use java 21.0.10-tem
mvn clean compile exec:exec
curl -k https://localhost:8443/api/verify-pqc

All three will return "pqcVerified": true when the PQC TLS handshake succeeds.

JDK Compatibility

Help and Contributions

If you hit any problem using Camel or have some feedback, then please let us know.

We also love contributors, so get involved :-)

The Camel riders!