updated parsing to handle CHOICE in ML-DSA.

Author: dghgit

core/src/main/java/org/bouncycastle/pqc/crypto/mldsa/MLDSAPrivateKeyParameters.java

@@ -5,6 +5,10 @@
 public class MLDSAPrivateKeyParameters
     extends MLDSAKeyParameters
 {
+    public static final int BOTH = 0;
+    public static final int SEED_ONLY = 1;
+    public static final int EXPANDED_KEY = 2;
+
     final byte[] rho;
     final byte[] k;
     final byte[] tr;
@@ -15,6 +19,8 @@ public class MLDSAPrivateKeyParameters
     private final byte[] t1;
     private final byte[] seed;
 
+    private final int prefFormat;
+
     public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] encoding)
     {
         this(params, encoding, null);
@@ -36,6 +42,7 @@ public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] rho, byte[] K, b
         this.t0 = Arrays.clone(t0);
         this.t1 = Arrays.clone(t1);
         this.seed = Arrays.clone(seed);
+        this.prefFormat = (seed != null) ? BOTH : EXPANDED_KEY;
     }
 
     public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] encoding, MLDSAPublicKeyParameters pubKey)
@@ -86,6 +93,36 @@ public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] encoding, MLDSAP
 
             this.seed = null;
         }
+        this.prefFormat = (seed != null) ? BOTH : EXPANDED_KEY;
+    }
+
+    private MLDSAPrivateKeyParameters(MLDSAPrivateKeyParameters params, int preferredFormat)
+    {
+        super(true, params.getParameters());
+
+        this.rho = params.rho;
+        this.k = params.k;
+        this.tr = params.tr;
+        this.s1 = params.s1;
+        this.s2 = params.s2;
+        this.t0 = params.t0;
+        this.t1 = params.t1;
+        this.seed = params.seed;
+        this.prefFormat = preferredFormat;
+    }
+
+    public MLDSAPrivateKeyParameters getParametersWithFormat(int format)
+    {
+        if (this.seed == null && format == SEED_ONLY)
+        {
+            throw new IllegalArgumentException("no seed available");
+        }
+        return new MLDSAPrivateKeyParameters(this, format);
+    }
+
+    public int getPreferredFormat()
+    {
+        return prefFormat;
     }
 
     public byte[] getEncoded()

core/src/main/java/org/bouncycastle/pqc/crypto/util/PrivateKeyInfoFactory.java

@@ -298,13 +298,13 @@ else if (privateKey instanceof MLDSAPrivateKeyParameters)
             AlgorithmIdentifier algorithmIdentifier = new AlgorithmIdentifier(Utils.mldsaOidLookup(params.getParameters()));
 
             byte[] seed = params.getSeed();
-            if (Properties.isOverrideSet("org.bouncycastle.mldsa.seedOnly"))
+            if (params.getPreferredFormat() == MLDSAPrivateKeyParameters.SEED_ONLY)
             {
-                if (seed == null)    // very difficult to imagine, but...
-                {
-                    throw new IOException("no seed available");
-                }
-                return new PrivateKeyInfo(algorithmIdentifier, seed, attributes);
+                return new PrivateKeyInfo(algorithmIdentifier, new DERTaggedObject(false, 0, new DEROctetString(params.getSeed())), attributes);
+            }
+            else if (params.getPreferredFormat() == MLDSAPrivateKeyParameters.EXPANDED_KEY)
+            {
+                return new PrivateKeyInfo(algorithmIdentifier, new DEROctetString(params.getEncoded()), attributes);
             }
             return new PrivateKeyInfo(algorithmIdentifier, getBasicPQCEncoding(params.getSeed(), params.getEncoded()), attributes);
         }
@@ -406,7 +406,7 @@ private static ASN1Sequence getBasicPQCEncoding(byte[] seed, byte[] expanded)
 
         if (expanded != null)
         {
-            v.add(new DERTaggedObject(false, 1, new DEROctetString(expanded)));
+            v.add(new DEROctetString(expanded));
         }
 
         return new DERSequence(v);

core/src/main/java/org/bouncycastle/pqc/crypto/util/Utils.java

@@ -8,6 +8,7 @@
 import org.bouncycastle.asn1.ASN1OctetString;
 import org.bouncycastle.asn1.ASN1Primitive;
 import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1TaggedObject;
 import org.bouncycastle.asn1.BERTags;
 import org.bouncycastle.asn1.DERNull;
 import org.bouncycastle.asn1.bc.BCObjectIdentifiers;
@@ -830,6 +831,11 @@ static ASN1Primitive parseData(byte[] data)
             {
                 return ASN1OctetString.getInstance(data);
             }
+
+            if ((data[0] & 0xff) == BERTags.TAGGED)
+            {
+                return ASN1OctetString.getInstance(ASN1TaggedObject.getInstance(data), false);
+            }
         }
 
         return null;