Tink Java v1.24.0

Tink is a multi-language, cross-platform library that provides simple and
misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.24.0

The complete list of changes since 1.23.0 can be found here.

New Features

• APIs which depend on what algorithms are registered now have an overload taking a configuration argument. Using these overloads allows to ensure that behavior is independent of what else is linked in the binary. For example, instead of keysetHandle.getPrimitive(Aead.class), users can now write keysetHandle.getPrimitive(TinkConfig2026.get(), Aead.class). Similary for key generation and serialization of keysets.

  The following configs are available: AeadConfig2026 (which does not contain the KMS algorithms; use KmsAeadConfig2026 for those), DeterministicAeadConfig2026, HybridConfig2026, JwtConfig2026, KeyDerivationConfig2026, MacConfig2026, PrfConfig2026, SignatureConfig2026, StreamingAeadConfig2026. In addition, TinkConfig2026 contains all of the above algorithms (except the KMS algorithms). Finally, RegistryConfiguration.java is available to make previous behavior (examining the registered algorithms) explicit.

  Finally, the Configuration interface needed to implement new behavior is completely public, and users can implement it themselves.

• Added support for JWT ML-DSA signatures.

• Added support for MLDSA44-Ed25519-SHA512 and MLDSA65-Ed25519-SHA512 Composite ML-DSA algorithms.

• X-Wing HPKE is now also available on Android. In particular, it is available natively on Android 17 (or above), or otherwise on Android 12 (or above) with SDK Extensions version 22 or later.

• Added predefined HPKE parameters.

• Added the Prehash primitive interface for computing prehashes of messages, to support the prehash-and-sign paradigm (such as ML-DSA External Mu).

• Updated 'org.conscrypt:conscrypt-openjdk-uber' to version 2.7.0.

Changes

• Changed the named parameter name for SLH-DSA-SHA2-128S with Tink output prefix type from SLH_DSA_SHA2_128S_TINK to SLH_DSA_SHA2_128S for consistency with the other Tink languages.
• In SignaturePemKeysetReader, treat Base64 decoding failures like other PEM key parsing errors.
• In SignaturePemKeysetReader, continue parsing multi-key PEM bundles after encountering an unparsable key.
• In SignaturePemKeysetReader, preserve the parsed RSA public exponent when importing RSA public keys instead of hardcoding 65537 (F4).
• Fixed unchecked runtime exceptions in JwkSetConverter.toPublicKeysetHandle and SignatureJwkSetConverter.toPublicKeysetHandle when importing malformed JWK sets, ensuring they consistently throw a GeneralSecurityException.
• Validate coordinate lengths against curve field size in JwkSetConverter and SignatureJwkSetConverter.
• Fixed unchecked runtime exceptions in JsonKeysetReader.read and JsonKeysetReader.readEncrypted when reading malformed keysets, ensuring they consistently throw an IOException.
• AesGcmSiv now uses Conscrypt if it's available on the class path, even if it is not installed. Previously, a Conscrypt provider needed to be installed for it to work.
• Enforce canonical Base64url encoding in JwtFormat.strictUrlSafeDecode, preventing signature/MAC malleability from unused trailing bits.
• Fixed StreamingAeadSeekableDecryptingChannel.read to always authenticate the final ciphertext segment when reaching the end of the plaintext, ensuring valid empty plaintexts return -1 (EOF) and rejecting truncated or unauthenticated empty trailing segments with an IOException.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.24.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.24.0'
}

Bazel:

Using bzlmod

bazel_dep(name = "tink_java")

git_override(
    module_name = "tink_java",
    remote = "https://github.com/tink-crypto/tink-java",
    tag = "v1.24.0",
)