Skip to content

Stabilize ML-DSA X.509 PKIs with published RFC 9881. #125834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vcsjones wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Stabilize ML-DSA X.509 PKIs with published RFC 9881. #125834

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/libraries/Common/src/System/Security/Cryptography/Asn1/MLDsaPrivateKeyAsn.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
emitType="ref">

<!--
https://github.com/lamps-wg/dilithium-certificates/blob/5b23428b08a53aacdb89d93422b81228433e34d8/draft-ietf-lamps-dilithium-certificates.md
https://datatracker.ietf.org/doc/rfc9881/ Appendix A.
ML-DSA-44-PrivateKey ::= CHOICE {
seed [0] OCTET STRING (SIZE (32)),
Expand Down
4 changes: 2 additions & 2 deletions src/libraries/Common/src/System/Security/Cryptography/Asn1/MLDsaPrivateKeyBothAsn.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@
emitType="ref">

<!--
https://github.com/lamps-wg/dilithium-certificates/blob/5b23428b08a53aacdb89d93422b81228433e34d8/draft-ietf-lamps-dilithium-certificates.md
https://datatracker.ietf.org/doc/rfc9881/ Appendix A.

both SEQUENCE {
seed OCTET STRING (SIZE (32)),
expandedKey OCTET STRING (SIZE (2560))
expandedKey OCTET STRING (SIZE (2560 / 4032 / 4896))
}
-->
<asn:OctetString name="Seed" />
Expand Down
29 changes: 0 additions & 29 deletions src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -665,7 +665,6 @@ public bool VerifyMu(ReadOnlySpan<byte> externalMu, ReadOnlySpan<byte> signature
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public byte[] ExportSubjectPublicKeyInfo()
{
ThrowIfDisposed();
Expand Down Expand Up @@ -695,7 +694,6 @@ public byte[] ExportSubjectPublicKeyInfo()
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public bool TryExportSubjectPublicKeyInfo(Span<byte> destination, out int bytesWritten)
{
ThrowIfDisposed();
Expand All @@ -718,7 +716,6 @@ public bool TryExportSubjectPublicKeyInfo(Span<byte> destination, out int bytesW
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public string ExportSubjectPublicKeyInfoPem()
{
ThrowIfDisposed();
Expand All @@ -745,7 +742,6 @@ public string ExportSubjectPublicKeyInfoPem()
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public byte[] ExportPkcs8PrivateKey()
{
ThrowIfDisposed();
Expand Down Expand Up @@ -774,7 +770,6 @@ public byte[] ExportPkcs8PrivateKey()
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public bool TryExportPkcs8PrivateKey(Span<byte> destination, out int bytesWritten)
{
ThrowIfDisposed();
Expand Down Expand Up @@ -818,7 +813,6 @@ public bool TryExportPkcs8PrivateKey(Span<byte> destination, out int bytesWritte
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
protected abstract bool TryExportPkcs8PrivateKeyCore(Span<byte> destination, out int bytesWritten);

/// <summary>
Expand All @@ -834,7 +828,6 @@ public bool TryExportPkcs8PrivateKey(Span<byte> destination, out int bytesWritte
/// <exception cref="CryptographicException">
/// An error occurred while exporting the key.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public string ExportPkcs8PrivateKeyPem()
{
ThrowIfDisposed();
Expand Down Expand Up @@ -869,7 +862,6 @@ public string ExportPkcs8PrivateKeyPem()
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters pbeParameters)
{
ArgumentNullException.ThrowIfNull(pbeParameters);
Expand Down Expand Up @@ -917,7 +909,6 @@ public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbePar
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, PbeParameters pbeParameters)
{
ArgumentNullException.ThrowIfNull(pbeParameters);
Expand All @@ -940,7 +931,6 @@ public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, P
/// <exception cref="ArgumentNullException">
/// <paramref name="password"/> or <paramref name="pbeParameters"/> is <see langword="null"/>.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public byte[] ExportEncryptedPkcs8PrivateKey(string password, PbeParameters pbeParameters)
{
ArgumentNullException.ThrowIfNull(password);
Expand Down Expand Up @@ -984,7 +974,6 @@ public byte[] ExportEncryptedPkcs8PrivateKey(string password, PbeParameters pbeP
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public bool TryExportEncryptedPkcs8PrivateKey(
ReadOnlySpan<char> password,
PbeParameters pbeParameters,
Expand Down Expand Up @@ -1045,7 +1034,6 @@ public bool TryExportEncryptedPkcs8PrivateKey(
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public bool TryExportEncryptedPkcs8PrivateKey(
ReadOnlySpan<byte> passwordBytes,
PbeParameters pbeParameters,
Expand All @@ -1072,7 +1060,6 @@ public bool TryExportEncryptedPkcs8PrivateKey(
/// <exception cref="ArgumentNullException">
/// <paramref name="password"/> or <paramref name="pbeParameters"/> is <see langword="null"/>.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public bool TryExportEncryptedPkcs8PrivateKey(
string password,
PbeParameters pbeParameters,
Expand Down Expand Up @@ -1112,7 +1099,6 @@ public bool TryExportEncryptedPkcs8PrivateKey(
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public string ExportEncryptedPkcs8PrivateKeyPem(
ReadOnlySpan<char> password,
PbeParameters pbeParameters)
Expand Down Expand Up @@ -1157,7 +1143,6 @@ public string ExportEncryptedPkcs8PrivateKeyPem(
/// <para>-or-</para>
/// <para>An error occurred while exporting the key.</para>
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public string ExportEncryptedPkcs8PrivateKeyPem(
ReadOnlySpan<byte> passwordBytes,
PbeParameters pbeParameters)
Expand All @@ -1176,7 +1161,6 @@ public string ExportEncryptedPkcs8PrivateKeyPem(
/// <exception cref="ArgumentNullException">
/// <paramref name="password"/> or <paramref name="pbeParameters"/> is <see langword="null"/>.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public string ExportEncryptedPkcs8PrivateKeyPem(
string password,
PbeParameters pbeParameters)
Expand Down Expand Up @@ -1370,7 +1354,6 @@ public static MLDsa GenerateKey(MLDsaAlgorithm algorithm)
/// The platform does not support ML-DSA. Callers can use the <see cref="IsSupported" /> property
/// to determine if the platform supports ML-DSA.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportSubjectPublicKeyInfo(ReadOnlySpan<byte> source)
{
Helpers.ThrowIfAsnInvalidLength(source);
Expand All @@ -1397,7 +1380,6 @@ static void SubjectPublicKeyReader(ReadOnlySpan<byte> key, in ValueAlgorithmIden
/// <exception cref="ArgumentNullException">
/// <paramref name="source" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportSubjectPublicKeyInfo(byte[] source)
{
ArgumentNullException.ThrowIfNull(source);
Expand Down Expand Up @@ -1435,7 +1417,6 @@ public static MLDsa ImportSubjectPublicKeyInfo(byte[] source)
/// The platform does not support ML-DSA. Callers can use the <see cref="IsSupported" /> property
/// to determine if the platform supports ML-DSA.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportPkcs8PrivateKey(ReadOnlySpan<byte> source)
{
Helpers.ThrowIfAsnInvalidLength(source);
Expand All @@ -1450,7 +1431,6 @@ public static MLDsa ImportPkcs8PrivateKey(ReadOnlySpan<byte> source)
/// <exception cref="ArgumentNullException">
/// <paramref name="source" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportPkcs8PrivateKey(byte[] source)
{
ArgumentNullException.ThrowIfNull(source);
Expand Down Expand Up @@ -1500,7 +1480,6 @@ public static MLDsa ImportPkcs8PrivateKey(byte[] source)
/// The platform does not support ML-DSA. Callers can use the <see cref="IsSupported" /> property
/// to determine if the platform supports ML-DSA.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, ReadOnlySpan<byte> source)
{
Helpers.ThrowIfAsnInvalidLength(source);
Expand Down Expand Up @@ -1550,7 +1529,6 @@ public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBy
/// The platform does not support ML-DSA. Callers can use the <see cref="IsSupported" /> property
/// to determine if the platform supports ML-DSA.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, ReadOnlySpan<byte> source)
{
Helpers.ThrowIfAsnInvalidLength(source);
Expand All @@ -1567,7 +1545,6 @@ public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password,
/// <exception cref="ArgumentNullException">
/// <paramref name="password" /> or <paramref name="source" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportEncryptedPkcs8PrivateKey(string password, byte[] source)
{
ArgumentNullException.ThrowIfNull(password);
Expand Down Expand Up @@ -1612,7 +1589,6 @@ public static MLDsa ImportEncryptedPkcs8PrivateKey(string password, byte[] sourc
/// </list>
/// </para>
/// </remarks>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromPem(ReadOnlySpan<char> source)
{
ThrowIfNotSupported();
Expand All @@ -1630,7 +1606,6 @@ public static MLDsa ImportFromPem(ReadOnlySpan<char> source)
/// <exception cref="ArgumentNullException">
/// <paramref name="source" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromPem(string source)
{
ArgumentNullException.ThrowIfNull(source);
Expand Down Expand Up @@ -1698,7 +1673,6 @@ public static MLDsa ImportFromPem(string source)
/// </para>
/// <para>This method supports the <c>ENCRYPTED PRIVATE KEY</c> PEM label.</para>
/// </remarks>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<char> password)
{
ThrowIfNotSupported();
Expand Down Expand Up @@ -1763,7 +1737,6 @@ public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySp
/// </para>
/// <para>This method supports the <c>ENCRYPTED PRIVATE KEY</c> PEM label.</para>
/// </remarks>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<byte> passwordBytes)
{
ThrowIfNotSupported();
Expand All @@ -1778,7 +1751,6 @@ public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySp
/// <exception cref="ArgumentNullException">
/// <paramref name="source" /> or <paramref name="password" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromEncryptedPem(string source, string password)
{
ArgumentNullException.ThrowIfNull(source);
Expand All @@ -1792,7 +1764,6 @@ public static MLDsa ImportFromEncryptedPem(string source, string password)
/// <exception cref="ArgumentNullException">
/// <paramref name="source" /> or <paramref name="passwordBytes" /> is <see langword="null" />.
/// </exception>
[Experimental(Experimentals.PostQuantumCryptographyDiagId, UrlFormat = Experimentals.SharedUrlFormat)]
public static MLDsa ImportFromEncryptedPem(string source, byte[] passwordBytes)
{
ArgumentNullException.ThrowIfNull(source);
Expand Down
2 changes: 1 addition & 1 deletion .../tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestsData.Ietf.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ namespace System.Security.Cryptography.Tests
{
public static partial class MLDsaTestsData
{
// Data is from https://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/09/
// Data is from https://datatracker.ietf.org/doc/rfc9881/ Appendix C.
internal static partial MLDsaKeyInfo IetfMLDsa44 => field ??= new MLDsaKeyInfo(
MLDsaAlgorithm.MLDsa44,
"d7b2b47254aae0db45e7930d4a98d2c97d8f1397d17" +
Expand Down
Loading
Loading