feat(docs): document hybrid post-quantum key wrapping support#343
feat(docs): document hybrid post-quantum key wrapping support#343marythought wants to merge 1 commit into
Conversation
Add documentation for the new hybrid PQC key types (X-Wing, ECDH+ML-KEM-768, ECDH+ML-KEM-1024) being added to the Java SDK in opentdf/java-sdk#368. Updates the feature matrix, encrypt options valid values, KASInfo type reference, KeyAccess type reference, and KAS public key endpoint documentation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughDocumentation-only update adding hybrid post-quantum cryptography (hybrid PQC) support details. Changes span four files: SDK TDF reference, encrypt options sample, KAS component docs, and the SDK feature matrix. New algorithm identifiers ( ChangesHybrid PQC Documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to introduce and detail support for hybrid post-quantum cryptography (PQC) algorithms across the Go, Java, and JavaScript SDKs, including Key Access Server (KAS) configurations and feature matrices. The review feedback suggests a minor formatting improvement to align the columns in the SDK feature matrix table.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| | - ABAC[^112] | Stable | Stable | Stable | | ||
| | - Key Mapping[^140] | Stable | Stable | Stable | | ||
| | - Obligations[^150] | Stable | Planned | Stable | | ||
| | - Hybrid PQC[^160] | Stable | Unstable | Planned | |
There was a problem hiding this comment.
The column separator | for the new Hybrid PQC row is misaligned by one character compared to the other rows in the table. Adding an extra space after [^160] will align the table columns perfectly for better readability in the raw markdown file.
| - Hybrid PQC[^160] | Stable | Unstable | Planned |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
code_samples/tdf/encrypt_options.mdx (1)
595-599:⚠️ Potential issue | 🟠 MajorIncorrect Java API name in sample (
WithWrappingKeyAlg).The method uses wrong casing: should be
Config.withWrappingKeyAlg(...)(lowercasew), notConfig.WithWrappingKeyAlg(...)(capitalW). This code would fail to compile. Additionally, recent SDK architectural changes (July 2025+) retrieve the wrapping algorithm fromKASInforather than directly fromConfig, so this entire approach may need refactoring to follow current SDK patterns.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@code_samples/tdf/encrypt_options.mdx` around lines 595 - 599, The method call `Config.WithWrappingKeyAlg(...)` has incorrect casing and should be changed to `Config.withWrappingKeyAlg(...)` with a lowercase 'w' to match the correct Java API convention. Additionally, verify whether the wrapping key algorithm configuration approach is still current with the SDK, as recent architectural changes may require retrieving this value from `KasInfo` instead of directly configuring it through the `Config` object. Update the code to follow the current SDK patterns if the wrapping algorithm should be sourced from the `kasInfo` parameter rather than set separately.
🧹 Nitpick comments (1)
code_samples/tdf/encrypt_options.mdx (1)
570-571: ⚡ Quick winUse SDK option name as the section header to avoid anchor collisions.
Please rename this option section header to the SDK option-style name (for example,
### WithWrappingKeyAlg) and update any local references accordingly. As per coding guidelines, “Use SDK option names for encrypt/decrypt option headers … to avoid anchor collisions with concept-level headers in parent docs.”Also applies to: 587-620
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@code_samples/tdf/encrypt_options.mdx` around lines 570 - 571, The section header describing hybrid post-quantum algorithms needs to be renamed from its current descriptive format to an SDK option-style name format (for example, using camelCase with a "With" prefix like WithWrappingKeyAlg). Rename the header around line 570-571 to match the appropriate SDK option name format, and then update all local references to this header throughout the document, including the sections noted around lines 587-620, to ensure consistency and avoid anchor collision conflicts with parent documentation headers.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@code_samples/tdf/encrypt_options.mdx`:
- Around line 595-599: The method call `Config.WithWrappingKeyAlg(...)` has
incorrect casing and should be changed to `Config.withWrappingKeyAlg(...)` with
a lowercase 'w' to match the correct Java API convention. Additionally, verify
whether the wrapping key algorithm configuration approach is still current with
the SDK, as recent architectural changes may require retrieving this value from
`KasInfo` instead of directly configuring it through the `Config` object. Update
the code to follow the current SDK patterns if the wrapping algorithm should be
sourced from the `kasInfo` parameter rather than set separately.
---
Nitpick comments:
In `@code_samples/tdf/encrypt_options.mdx`:
- Around line 570-571: The section header describing hybrid post-quantum
algorithms needs to be renamed from its current descriptive format to an SDK
option-style name format (for example, using camelCase with a "With" prefix like
WithWrappingKeyAlg). Rename the header around line 570-571 to match the
appropriate SDK option name format, and then update all local references to this
header throughout the document, including the sections noted around lines
587-620, to ensure consistency and avoid anchor collision conflicts with parent
documentation headers.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bd1ec88e-22bd-49f0-9b80-abad52b2fb0f
📒 Files selected for processing (4)
code_samples/tdf/encrypt_options.mdxdocs/appendix/matrix.mdxdocs/components/key_access.mddocs/sdks/tdf.mdx
|
📄 Preview deployed to https://opentdf-docs-pr-343.surge.sh |
1 participant
Summary
hpqt:xwing,hpqt:secp256r1-mlkem768,hpqt:secp384r1-mlkem1024) in the Wrapping Key Algorithm encrypt option for Go and Java SDKsAlgorithmfield docs to reference hybrid algorithmsKeyTypefield to include"hybrid-wrapped"alongside"wrapped"and"ec-wrapped"Companion to opentdf/java-sdk#368 which adds the Java SDK implementation.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit