Skip to content

Commit 9b22e61

Browse files
author
Antoine Lochet
committed
Added ML-DSA support
1 parent 4f296fa commit 9b22e61

42 files changed

Lines changed: 3128 additions & 22 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,42 @@ jobs:
7676
run: |
7777
make check || (find . -name test-suite.log -exec cat {} \; && false)
7878
79+
linux_ossl_35:
80+
name: Linux with OpenSSL 3.5.2
81+
runs-on: ubuntu-24.04
82+
steps:
83+
- uses: actions/checkout@v4
84+
- name: Prepare
85+
env:
86+
OPENSSL_VERSION: 3.5.2
87+
OPENSSL_INSTALL_DIR: /usr/local/openssl-3.5
88+
LDFLAGS: "-Wl,-R/usr/local/openssl-3.5/lib64 -L/usr/local/openssl-3.5/lib64"
89+
run: |
90+
sudo apt-get update -qq
91+
sudo apt-get install -y libcppunit-dev p11-kit build-essential checkinstall zlib1g-dev sudo autoconf libtool git
92+
# Install OpenSSL 3.5
93+
curl -L -O https://github.com/openssl/openssl/releases/download/openssl-${{ env.OPENSSL_VERSION }}/openssl-${{ env.OPENSSL_VERSION }}.tar.gz
94+
tar -xf openssl-${{ env.OPENSSL_VERSION }}.tar.gz
95+
cd openssl-${{ env.OPENSSL_VERSION }}
96+
./config shared zlib no-ssl3 no-weak-ssl-ciphers --prefix=${{ env.OPENSSL_INSTALL_DIR }} --openssldir=${{ env.OPENSSL_INSTALL_DIR }}
97+
make -j$(nproc) > build.log
98+
sudo make install > install.log
99+
cd ${{ env.OPENSSL_INSTALL_DIR }}
100+
sudo ln -s lib64 lib
101+
- name: Build
102+
env:
103+
# Once all OpenSSL deprecations fixed, uncomment this
104+
# CXXFLAGS: -Werror
105+
OPENSSL_INSTALL_DIR: /usr/local/openssl-3.5
106+
LDFLAGS: "-Wl,-R/usr/local/openssl-3.5/lib64 -L/usr/local/openssl-3.5/lib64"
107+
run: |
108+
./autogen.sh
109+
./configure --with-crypto-backend=openssl --with-openssl=${{ env.OPENSSL_INSTALL_DIR }}
110+
make -j$(nproc)
111+
- name: Test
112+
run: |
113+
make check || (find . -name test-suite.log -exec cat {} \; && false)
114+
79115
macos:
80116
name: macOS (${{ matrix.backend }})
81117
runs-on: macos-14

‎CMAKE-NOTES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Some options (more can be found in CMakeLists.txt):
1111
-DBUILD_TESTS=ON Compile tests along with libraries
1212
-DDISABLE_NON_PAGED_MEMORY=ON Disable non-paged memory for secure storage
1313
-DENABLE_EDDSA=ON Enable support for EDDSA
14+
-DENABLE_MLDSA=ON Enable support for ML-DSA
1415
-DWITH_MIGRATE=ON Build migration tool
1516
-DWITH_CRYPTO_BACKEND=openssl Select crypto backend (openssl|botan)
1617

‎CMAKE-WIN-NOTES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ Some options (more can be found in CMakeLists.txt):
5252

5353
-DBUILD_TESTS=ON Compile tests along with libraries
5454
-DENABLE_EDDSA=ON Enable support for EDDSA
55+
-DENABLE_MLDSA=ON Enable support for ML-DSA
5556
-DWITH_MIGRATE=ON Build migration tool
5657
-DWITH_CRYPTO_BACKEND= Select crypto backend (openssl|botan)
5758
-DDISABLE_NON_PAGED_MEMORY=ON Disable non-paged memory for secure storage

‎CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ option(DISABLE_VISIBILITY "Disables and unsets -fvisibility=hidden" OFF)
88
option(ENABLE_64bit "Enable 64-bit compiling" OFF)
99
option(ENABLE_ECC "Enable support for ECC" ON)
1010
option(ENABLE_EDDSA "Enable support for EDDSA" ON)
11+
option(ENABLE_MLDSA "Enable support for ML-DSA" ON)
1112
option(ENABLE_GOST "Enable support for GOST" OFF)
1213
option(ENABLE_FIPS "Enable support for FIPS 140-2 mode" OFF)
1314
option(ENABLE_P11_KIT "Enable p11-kit integration" ON)

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ Options:
8282
--enable-ecc Enable support for ECC (default detect)
8383
--enable-gost Enable support for GOST (default detect)
8484
--enable-eddsa Enable support for EDDSA (default detect)
85+
--enable-mldsa Enable support for ML-DSA (default detect)
8586
--disable-visibility Disable hidden visibilty link mode [enabled]
8687
--with-crypto-backend Select crypto backend (openssl|botan)
8788
--with-openssl=PATH Specify prefix of path of OpenSSL

‎config.h.in.cmake‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,9 @@
151151
/* Compile with EDDSA support */
152152
#cmakedefine WITH_EDDSA @WITH_EDDSA@
153153

154+
/* Compile with ML-DSA support */
155+
#cmakedefine WITH_ML_DSA @WITH_ML_DSA@
156+
154157
/* Compile with FIPS 140-2 mode */
155158
#cmakedefine WITH_FIPS @WITH_FIPS@
156159

‎m4/acx_botan_mldsa.m4‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
AC_DEFUN([ACX_BOTAN_MLDSA],[
2+
AC_MSG_CHECKING(for Botan ML-DSA support)
3+
4+
tmp_CPPFLAGS=$CPPFLAGS
5+
tmp_LIBS=$LIBS
6+
7+
CPPFLAGS="$CPPFLAGS $CRYPTO_INCLUDES"
8+
LIBS="$CRYPTO_LIBS $LIBS"
9+
10+
AC_LANG_PUSH([C++])
11+
AC_CACHE_VAL([acx_cv_lib_botan_mldsa_support],[
12+
acx_cv_lib_botan_mldsa_support=no
13+
AC_RUN_IFELSE([
14+
AC_LANG_SOURCE([[
15+
#include <botan/version.h>
16+
int main()
17+
{
18+
// TODO
19+
return 1;
20+
}
21+
]])
22+
],[
23+
AC_MSG_RESULT([yes])
24+
acx_cv_lib_botan_mldsa_support=yes
25+
],[
26+
AC_MSG_RESULT([no])
27+
acx_cv_lib_botan_mldsa_support=no
28+
],[
29+
AC_MSG_WARN([Cannot test, assuming no ML-DSA])
30+
acx_cv_lib_botan_mldsa_support=no
31+
])
32+
])
33+
AC_LANG_POP([C++])
34+
35+
CPPFLAGS=$tmp_CPPFLAGS
36+
LIBS=$tmp_LIBS
37+
have_lib_botan_mldsa_support="${acx_cv_lib_botan_mldsa_support}"
38+
])

‎m4/acx_crypto_backend.m4‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
2828
[enable_eddsa="detect"]
2929
)
3030
31+
# Add ML-DSA check
32+
33+
AC_ARG_ENABLE(mldsa,
34+
AS_HELP_STRING([--enable-mldsa],
35+
[Enable support for ML-DSA (default detect)]
36+
),
37+
[enable_mldsa="${enableval}"],
38+
[enable_mldsa="detect"]
39+
)
40+
3141
# Second check for the FIPS 140-2 mode
3242
3343
AC_ARG_ENABLE(fips,
@@ -100,6 +110,15 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
100110
detect*-no*) enable_eddsa="no";;
101111
esac
102112
113+
case "${enable_mldsa}" in
114+
yes|detect) ACX_OPENSSL_MLDSA;;
115+
esac
116+
case "${enable_mldsa}-${have_lib_openssl_mldsa_support}" in
117+
yes-no) AC_MSG_ERROR([OpenSSL library has no ML-DSA support]);;
118+
detect-yes) enable_mldsa="yes";;
119+
detect-no) enable_mldsa="no";;
120+
esac
121+
103122
case "${enable_gost}-${enable_fips}" in
104123
yes-yes) AC_MSG_ERROR([GOST is not FIPS approved]);;
105124
yes-no|detect-no) ACX_OPENSSL_GOST;;
@@ -166,6 +185,14 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
166185
detect-*) enable_eddsa="${have_lib_botan_eddsa_support}";;
167186
esac
168187
188+
case "${enable_mldsa}" in
189+
yes|detect) ACX_BOTAN_MLDSA;;
190+
esac
191+
case "${enable_mldsa}-${have_lib_botan_mldsa_support}" in
192+
yes-no) AC_MSG_ERROR([Botan library has no ML-DSA support]);;
193+
detect-*) enable_mldsa="${have_lib_botan_mldsa_support}";;
194+
esac
195+
169196
case "${enable_gost}" in
170197
yes|detect) ACX_BOTAN_GOST;;
171198
esac
@@ -231,6 +258,19 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
231258
fi
232259
AM_CONDITIONAL([WITH_EDDSA], [test "x${enable_eddsa}" = "xyes"])
233260
261+
AC_MSG_CHECKING(for ML-DSA support)
262+
if test "x${enable_mldsa}" = "xyes"; then
263+
AC_MSG_RESULT(yes)
264+
AC_DEFINE_UNQUOTED(
265+
[WITH_ML_DSA],
266+
[],
267+
[Compile with ML-DSA support]
268+
)
269+
else
270+
AC_MSG_RESULT(no)
271+
fi
272+
AM_CONDITIONAL([WITH_ML_DSA], [test "x${enable_mldsa}" = "xyes"])
273+
234274
235275
AC_SUBST(CRYPTO_INCLUDES)
236276
AC_SUBST(CRYPTO_LIBS)

‎m4/acx_openssl_mldsa.m4‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
AC_DEFUN([ACX_OPENSSL_MLDSA],[
2+
AC_MSG_CHECKING(for OpenSSL ML-DSA support)
3+
4+
tmp_CPPFLAGS=$CPPFLAGS
5+
tmp_LIBS=$LIBS
6+
7+
CPPFLAGS="$CPPFLAGS $CRYPTO_INCLUDES"
8+
LIBS="$CRYPTO_LIBS $LIBS"
9+
10+
AC_LANG_PUSH([C])
11+
AC_CACHE_VAL([acx_cv_lib_openssl_mldsa_support],[
12+
acx_cv_lib_openssl_mldsa_support=no
13+
AC_RUN_IFELSE([
14+
AC_LANG_SOURCE([[
15+
#include <openssl/evp.h>
16+
#include <openssl/objects.h>
17+
int main()
18+
{
19+
EVP_PKEY_CTX *pctx =
20+
EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
21+
if (pctx == NULL)
22+
return 1;
23+
return 0;
24+
}
25+
]])
26+
],[
27+
AC_MSG_RESULT([yes])
28+
acx_cv_lib_openssl_mldsa_support=yes
29+
],[
30+
AC_MSG_RESULT([no])
31+
acx_cv_lib_openssl_mldsa_support=no
32+
],[
33+
AC_MSG_WARN([Cannot test, ML-DSA])
34+
acx_cv_lib_openssl_mldsa_support=no
35+
])
36+
])
37+
38+
AC_LANG_POP([C])
39+
40+
CPPFLAGS=$tmp_CPPFLAGS
41+
LIBS=$tmp_LIBS
42+
have_lib_openssl_mldsa_support="${acx_cv_lib_openssl_mldsa_support}"
43+
])

‎src/bin/dump/tables.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ void fill_CKA_table(std::map<unsigned long, std::string> &t)
150150
t[CKA_OS_TOKENFLAGS] = "CKA_OS_TOKENFLAGS";
151151
t[CKA_OS_SOPIN] = "CKA_OS_SOPIN";
152152
t[CKA_OS_USERPIN] = "CKA_OS_USERPIN";
153+
t[CKA_PARAMETER_SET] = "CKA_PARAMETER_SET";
154+
t[CKA_SEED] = "CKA_SEED";
153155
}
154156

155157
void fill_CKM_table(std::map<unsigned long, std::string> &t)
@@ -478,6 +480,8 @@ void fill_CKM_table(std::map<unsigned long, std::string> &t)
478480
t[CKM_RSA_PKCS_OAEP_TPM_1_1] = "CKM_RSA_PKCS_OAEP_TPM_1_1";
479481
t[CKM_EC_EDWARDS_KEY_PAIR_GEN] = "CKM_EC_EDWARDS_KEY_PAIR_GEN";
480482
t[CKM_EDDSA] = "CKM_EDDSA";
483+
t[CKM_ML_DSA_KEY_PAIR_GEN] = "CKM_ML_DSA_KEY_PAIR_GEN";
484+
t[CKM_ML_DSA] = "CKM_ML_DSA";
481485
}
482486

483487
void fill_CKO_table(std::map<unsigned long, std::string> &t)
@@ -544,6 +548,7 @@ void fill_CKK_table(std::map<unsigned long, std::string> &t)
544548
t[CKK_GOSTR3411] = "CKK_GOSTR3411";
545549
t[CKK_GOST28147] = "CKK_GOST28147";
546550
t[CKK_EC_EDWARDS] = "CKK_EC_EDWARDS";
551+
t[CKK_ML_DSA] = "CKK_ML_DSA";
547552
}
548553

549554
void fill_CKC_table(std::map<unsigned long, std::string> &t)

0 commit comments

Comments
 (0)