feat(core): Re-enable pq algorithms after format change by dmihalcik-virtru · Pull Request #3651 · opentdf/platform

dmihalcik-virtru · 2026-06-22T18:28:58Z

Reverts #3625

Summary by CodeRabbit

New Features
- Added support for three hybrid post-quantum key algorithms: X-Wing, Secp256r1/MLKEM768, and Secp384r1/MLKEM1024.
Documentation
- Updated key creation, import, and rotation documentation to reflect new algorithm options.

gemini-code-assist · 2026-06-22T18:29:08Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request re-enables support for post-quantum hybrid algorithms within the core platform tools. By updating the key generation logic, validation utilities, and CLI command mappings, the system now fully supports the use of X-Wing and various ML-KEM hybrid key types. These changes ensure that the platform remains aligned with modern cryptographic standards while maintaining consistent behavior across key management operations.

Highlights

Quantum-Resistant Algorithm Support: Enabled support for HPQT (Hybrid Post-Quantum) algorithms, including X-Wing, P256-MLKEM768, and P384-MLKEM1024, across the key generation, validation, and CLI command workflows.
Documentation Updates: Updated the CLI documentation for key creation, import, and rotation to include the newly supported HPQT algorithms.
Test Coverage: Added comprehensive unit tests for key generation and PEM validation to ensure the new hybrid algorithms function correctly and handle mismatches appropriately.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Quantum keys in hybrid light, / Securing data, holding tight. / From X-Wing wings to ML-KEM, / We guard the code, a digital gem.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-06-22T18:29:08Z

Warning

Review limit reached

@dmihalcik-virtru, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 15 minutes and 15 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d7bb9aa1-ef12-4bde-be5f-8806d5424abf

📥 Commits

Reviewing files that changed from the base of the PR and between ef0d336 and 32f61e1.

📒 Files selected for processing (1)

otdfctl/e2e/kas-keys.bats

📝 Walkthrough

Walkthrough

This PR adds three HPQT hybrid key algorithms to otdfctl key generation, CLI algorithm conversion, and PEM validation, updates tests for those paths, and lists the new algorithm values in key command documentation.

Changes

HPQT hybrid key support

Layer / File(s)	Summary
CLI algorithm handling `otdfctl/cmd/policy/kasKeys.go`, `otdfctl/cmd/policy/kasKeys_test.go`, `otdfctl/pkg/cli/sdkHelpers.go`, `otdfctl/pkg/cli/sdkHelpers_test.go`	`generateKeyPair` and CLI string↔enum helpers now support `hpqt:xwing`, `hpqt:secp256r1-mlkem768`, and `hpqt:secp384r1-mlkem1024`, with tests covering key generation and round-trip conversion.
PEM validation for hybrids `otdfctl/pkg/utils/pemvalidate.go`, `otdfctl/pkg/utils/pemvalidate_test.go`	Public-key PEM validation now recognizes the same HPQT algorithms and checks parsed hybrid key types, with tests for valid keys and mismatch errors.
Documented algorithm options `otdfctl/docs/man/policy/kas-registry/key/create.md`, `otdfctl/docs/man/policy/kas-registry/key/import.md`, `otdfctl/docs/man/policy/kas-registry/key/rotate.md`	Key create, import, and rotate docs now include the three HPQT algorithm strings in their supported algorithm tables.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

opentdf/platform#3276: Adds related HPQT hybrid key support in the underlying crypto and wrapping paths that this PR now exposes through otdfctl.
opentdf/platform#3625: Touches the same otdfctl HPQT generation, mapping, and validation paths, but removes or disables the handling that this PR reintroduces.

Suggested labels

pqc, docs, comp:lib:ocrypto

Suggested reviewers

elizabethhealy

Poem

🐇 I found three hybrid keys in clover bright,
and tucked them into otdfctl just right.
With PEMs that match and docs in line,
the tests all nibble through just fine.
Hop, little algorithms, onward in rhyme.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: re-enabling PQ algorithms after the prior format-related disablement.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch revert-3625-DSPX-3396-disable-hybrid

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request introduces support for HPQT hybrid algorithms (hpqt:xwing, hpqt:secp256r1-mlkem768, and hpqt:secp384r1-mlkem1024) in the otdfctl utility. The changes implement key pair generation, CLI string-to-enum mapping, and PEM validation for these new algorithms, along with updated documentation and comprehensive unit tests. I have no feedback to provide as there are no review comments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

github-actions · 2026-06-22T18:35:04Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	193.932267ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.151502ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	431.909712ms
Throughput	231.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.672012015s
Average Latency	465.202023ms
Throughput	107.13 requests/second

github-actions · 2026-06-22T18:43:49Z

X-Test Results

✅ go@main-pull-3651
✅ go@main-v0.9.0
✅ java@main-pull-3651
✅ js@main-pull-3651
✅ js@main-v0.9.0
✅ java@main-v0.9.0
cukes-report
opentdf~~platform~~D6HMA8.dockerbuild
govulncheck-failure-5
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-3

This reverts commit 4a7353d.

github-actions · 2026-06-23T14:18:55Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.905223ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.828526ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	473.312222ms
Throughput	211.28 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.101034197s
Average Latency	468.827245ms
Throughput	106.15 requests/second

github-actions · 2026-06-23T14:28:14Z

github-actions · 2026-06-23T17:42:56Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.512893ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	119.35747ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	440.221345ms
Throughput	227.16 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.492468291s
Average Latency	432.861391ms
Throughput	114.96 requests/second

github-actions · 2026-06-23T17:52:10Z

c-r33d

We should probably add a bats test for creating a key of these new algorithm types.

Add e2e bats coverage for creating keys with the new hybrid post-quantum algorithms (hpqt:xwing, hpqt:secp256r1-mlkem768, hpqt:secp384r1-mlkem1024) via local mode. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-06-23T18:20:47Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.230892ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.101172ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	686.264467ms
Throughput	145.72 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.511173984s
Average Latency	443.242732ms
Throughput	112.33 requests/second

github-actions · 2026-06-23T18:21:22Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-06-23T18:30:29Z

dmihalcik-virtru requested a review from a team as a code owner June 22, 2026 18:28

dmihalcik-virtru requested a review from sujankota June 22, 2026 18:29

github-actions Bot added the size/s label Jun 22, 2026

gemini-code-assist Bot reviewed Jun 22, 2026

View reviewed changes

Revert "feat(core): Disable pq algorithms due to format change (#3625)"

ef0d336

This reverts commit 4a7353d.

dmihalcik-virtru force-pushed the revert-3625-DSPX-3396-disable-hybrid branch from df3ac94 to ef0d336 Compare June 23, 2026 14:12

sujankota previously approved these changes Jun 23, 2026

View reviewed changes

dmihalcik-virtru enabled auto-merge June 23, 2026 17:55

c-r33d reviewed Jun 23, 2026

View reviewed changes

test(otdfctl): add bats tests for creating hybrid (HPQT) keys

32f61e1

Add e2e bats coverage for creating keys with the new hybrid post-quantum algorithms (hpqt:xwing, hpqt:secp256r1-mlkem768, hpqt:secp384r1-mlkem1024) via local mode. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

dmihalcik-virtru dismissed sujankota’s stale review via 32f61e1 June 23, 2026 18:14

sujankota approved these changes Jun 23, 2026

View reviewed changes

dmihalcik-virtru requested a review from c-r33d June 23, 2026 18:52

c-r33d approved these changes Jun 23, 2026

View reviewed changes

dmihalcik-virtru added this pull request to the merge queue Jun 23, 2026

Merged via the queue into main with commit 005f9de Jun 23, 2026
45 checks passed

dmihalcik-virtru deleted the revert-3625-DSPX-3396-disable-hybrid branch June 23, 2026 19:19

opentdf-automation Bot mentioned this pull request Jun 23, 2026

chore(main): release otdfctl 0.34.0 #3600

Merged

coderabbitai Bot mentioned this pull request Jun 24, 2026

feat(kas): Adds FIPS-203 wrap with ML-KEM-768/1024 #3652

Merged

Uh oh!

Conversation

dmihalcik-virtru commented Jun 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jun 22, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

github-actions Bot commented Jun 22, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 22, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jun 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 23, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jun 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 23, 2026

X-Test Results

Uh oh!

c-r33d left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 23, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Jun 23, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dmihalcik-virtru commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading