Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request expands the Post-Quantum Cryptography (PQC) User Guide to cover both gRPC and HTTP/JSON transports, adding comprehensive sections on gRPC transport architecture, platform compatibility, verification methods, and custom configurations. The review feedback suggests correcting the Netty SSL logging instructions to configure the logging framework directly rather than using a JVM system property, and removing an unused import in the gRPC configuration code snippet.
49f06d4 to
8ba5144
Compare
8ba5144 to
cf1aeb9
Compare
| - Only the initial **TLS 1.3 cryptographic handshake** performed when establishing a connection to Google Cloud service endpoints. The client automatically negotiates hybrid post-quantum key exchange (`X25519MLKEM768`) instead of classical-only key exchange (`X25519`). | ||
|
|
||
| ### Supported Key Exchange Algorithms & Negotiation | ||
| Across all supported transports, Google Cloud Java client libraries negotiate TLS 1.3 key exchange by offering a preference-ordered list of post-quantum and classical named groups. Today, the primary algorithms negotiated with Google Cloud endpoints are: |
There was a problem hiding this comment.
all supported transports sounds like there are more transports than grpc and httpjson
| gRPC is the default transport across Google Cloud Java client libraries. | ||
|
|
||
| #### Minimum Required Versions | ||
| We recommend using Google Cloud's **`libraries-bom` (version `26.88.0+`)** to guarantee that dependencies have compatible, required versions. |
There was a problem hiding this comment.
Maybe highlight that libraries-bom is recommended and managing dependencies directly is discouraged?
| If you need to use Conscrypt for high-performance TLS but want to explicitly disable post-quantum hybrid groups (for example, to isolate a network middlebox issue or benchmark legacy performance): | ||
| ### 4.1 Custom gRPC Configurations | ||
|
|
||
| #### Option 1: Forcing Classical-Only Key Exchange (Disabling PQC) |
There was a problem hiding this comment.
What are the use cases of disabling PQC?
2 participants
Summary
This pull request expands the Post-Quantum Cryptography (PQC) User Guide in
docs/post_quantum_cryptography_guide.mdto cover gRPC transport in addition to HTTP/JSON.This PR is stacked on top of PR #13963 (
pqc-user-guide).Highlights
grpc-netty-shadedtransport engine bundling BoringSSL (netty-tcnative-boringssl-static) with built-in PQC hybrid key exchange support (X25519MLKEM768) in gRPC-Java 1.83.0+.ManagedChannel) and how TLS overhead occurs once upon connection establishment.-Djavax.net.debugflags do not capture gRPC handshakes when usinggrpc-netty-shaded.-Dio.grpc.netty.shaded.io.netty.handler.ssl=DEBUG) andClientInterceptorresponse header verification.InstantiatingGrpcChannelProvider.Builder.setChannelConfigurator(...).