Skip to content

Commit c1c490d

Browse files
peterdettmanpeterdettman
committed
BCJSSE: Finalize and enable ML-DSA support
- see draft-ietf-tls-mldsa-00
1 parent 4fe963d commit c1c490d

File tree

15 files changed

+129
-113
lines changed

15 files changed

+129
-113
lines changed

‎tls/src/main/java/org/bouncycastle/jsse/provider/SignatureSchemeInfo.java‎

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ class SignatureSchemeInfo
4343
// NOTE: Not all of these are necessarily enabled/supported; it will be checked at runtime
4444
private enum All
4545
{
46-
ed25519(SignatureScheme.ed25519, "Ed25519", "Ed25519"),
47-
ed448(SignatureScheme.ed448, "Ed448", "Ed448"),
46+
ed25519(SignatureScheme.ed25519, "Ed25519", true),
47+
ed448(SignatureScheme.ed448, "Ed448", true),
4848

4949
ecdsa_secp256r1_sha256(SignatureScheme.ecdsa_secp256r1_sha256, "SHA256withECDSA", "EC"),
5050
ecdsa_secp384r1_sha384(SignatureScheme.ecdsa_secp384r1_sha384, "SHA384withECDSA", "EC"),
@@ -64,18 +64,18 @@ private enum All
6464
rsa_pss_rsae_sha384(SignatureScheme.rsa_pss_rsae_sha384, "SHA384withRSAandMGF1", "RSA"),
6565
rsa_pss_rsae_sha512(SignatureScheme.rsa_pss_rsae_sha512, "SHA512withRSAandMGF1", "RSA"),
6666

67+
// NOTE: Not supported pre-13, but that is enforced by TLS protocol code rather than at the (BC)JSSE level.
68+
mldsa44(SignatureScheme.mldsa44, "ML-DSA-44", false),
69+
mldsa65(SignatureScheme.mldsa65, "ML-DSA-65", false),
70+
mldsa87(SignatureScheme.mldsa87, "ML-DSA-87", false),
71+
72+
sm2sig_sm3(SignatureScheme.sm2sig_sm3, "SM3withSM2", "EC"),
73+
6774
// Deprecated: only for certs in 1.3
6875
rsa_pkcs1_sha256(SignatureScheme.rsa_pkcs1_sha256, "SHA256withRSA", "RSA", true),
6976
rsa_pkcs1_sha384(SignatureScheme.rsa_pkcs1_sha384, "SHA384withRSA", "RSA", true),
7077
rsa_pkcs1_sha512(SignatureScheme.rsa_pkcs1_sha512, "SHA512withRSA", "RSA", true),
7178

72-
sm2sig_sm3(SignatureScheme.sm2sig_sm3, "SM3withSM2", "EC"),
73-
74-
// TODO[tls] Need mechanism for restricting signature schemes to TLS 1.3+ before adding
75-
// DRAFT_mldsa44(SignatureScheme.DRAFT_mldsa44, "ML-DSA-44", "ML-DSA-44"),
76-
// DRAFT_mldsa65(SignatureScheme.DRAFT_mldsa65, "ML-DSA-65", "ML-DSA-65"),
77-
// DRAFT_mldsa87(SignatureScheme.DRAFT_mldsa87, "ML-DSA-87", "ML-DSA-87"),
78-
7979
/*
8080
* Legacy/Historical: mostly not supported in 1.3, except ecdsa_sha1 and rsa_pkcs1_sha1 are
8181
* still permitted as a last resort for certs.
@@ -96,52 +96,58 @@ private enum All
9696
private final String jcaSignatureAlgorithmBC;
9797
private final String keyAlgorithm;
9898
private final String keyType13;
99-
private final boolean supportedPost13;
10099
private final boolean supportedPre13;
100+
private final boolean supportedPost13;
101101
private final boolean supportedCerts13;
102102
private final int namedGroup13;
103103

104-
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm)
104+
private All(int signatureScheme, String algorithm, boolean supportedPre13)
105105
{
106-
this(signatureScheme, jcaSignatureAlgorithm, keyAlgorithm, true, true,
106+
this(signatureScheme, algorithm, algorithm, supportedPre13, true, true,
107107
SignatureScheme.getNamedGroup(signatureScheme));
108108
}
109109

110-
// Deprecated/Legacy
111-
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm, boolean supportedCerts13)
110+
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm)
112111
{
113-
this(signatureScheme, jcaSignatureAlgorithm, keyAlgorithm, false, supportedCerts13, -1);
112+
this(signatureScheme, jcaSignatureAlgorithm, keyAlgorithm, true, true, true,
113+
SignatureScheme.getNamedGroup(signatureScheme));
114114
}
115115

116-
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm, boolean supportedPost13,
117-
boolean supportedCerts13, int namedGroup13)
116+
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm, boolean supportedPre13,
117+
boolean supportedPost13, boolean supportedCerts13, int namedGroup13)
118118
{
119119
this(signatureScheme, SignatureScheme.getName(signatureScheme), jcaSignatureAlgorithm, keyAlgorithm,
120-
supportedPost13, supportedCerts13, namedGroup13);
120+
supportedPre13, supportedPost13, supportedCerts13, namedGroup13);
121+
}
122+
123+
// Deprecated/Legacy
124+
private All(int signatureScheme, String jcaSignatureAlgorithm, String keyAlgorithm, boolean supportedCerts13)
125+
{
126+
this(signatureScheme, jcaSignatureAlgorithm, keyAlgorithm, true, false, supportedCerts13, -1);
121127
}
122128

123129
// Historical
124130
private All(int signatureScheme, String name, String jcaSignatureAlgorithm, String keyAlgorithm)
125131
{
126-
this(signatureScheme, name, jcaSignatureAlgorithm, keyAlgorithm, false, false, -1);
132+
this(signatureScheme, name, jcaSignatureAlgorithm, keyAlgorithm, true, false, false, -1);
127133
}
128134

129135
private All(int signatureScheme, String name, String jcaSignatureAlgorithm, String keyAlgorithm,
130-
boolean supportedPost13, boolean supportedCerts13, int namedGroup13)
136+
boolean supportedPre13, boolean supportedPost13, boolean supportedCerts13, int namedGroup13)
131137
{
132138
String keyType13 = JsseUtils.getKeyType13(keyAlgorithm, namedGroup13);
133139
String jcaSignatureAlgorithmBC = JsseUtils.getJcaSignatureAlgorithmBC(jcaSignatureAlgorithm, keyAlgorithm);
134140

135-
136141
this.signatureScheme = signatureScheme;
137142
this.name = name;
138143
this.text = name + "(0x" + Integer.toHexString(signatureScheme) + ")";
139144
this.jcaSignatureAlgorithm = jcaSignatureAlgorithm;
140145
this.jcaSignatureAlgorithmBC = jcaSignatureAlgorithmBC;
141146
this.keyAlgorithm = keyAlgorithm;
142147
this.keyType13 = keyType13;
148+
this.supportedPre13 = supportedPre13 &&
149+
(namedGroup13 < 0 || NamedGroup.canBeNegotiated(namedGroup13, ProtocolVersion.TLSv12));
143150
this.supportedPost13 = supportedPost13;
144-
this.supportedPre13 = (namedGroup13 < 0) || NamedGroup.canBeNegotiated(namedGroup13, ProtocolVersion.TLSv12);
145151
this.supportedCerts13 = supportedCerts13;
146152
this.namedGroup13 = namedGroup13;
147153
}

‎tls/src/main/java/org/bouncycastle/tls/SignatureAndHashAlgorithm.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ public class SignatureAndHashAlgorithm
2121
create(HashAlgorithm.Intrinsic, SignatureAlgorithm.gostr34102012_256);
2222
public static final SignatureAndHashAlgorithm gostr34102012_512 =
2323
create(HashAlgorithm.Intrinsic, SignatureAlgorithm.gostr34102012_512);
24-
public static final SignatureAndHashAlgorithm DRAFT_mldsa44 = create(SignatureScheme.DRAFT_mldsa44);
25-
public static final SignatureAndHashAlgorithm DRAFT_mldsa65 = create(SignatureScheme.DRAFT_mldsa65);
26-
public static final SignatureAndHashAlgorithm DRAFT_mldsa87 = create(SignatureScheme.DRAFT_mldsa87);
24+
public static final SignatureAndHashAlgorithm mldsa44 = create(SignatureScheme.mldsa44);
25+
public static final SignatureAndHashAlgorithm mldsa65 = create(SignatureScheme.mldsa65);
26+
public static final SignatureAndHashAlgorithm mldsa87 = create(SignatureScheme.mldsa87);
2727
public static final SignatureAndHashAlgorithm rsa_pss_rsae_sha256 =
2828
create(SignatureScheme.rsa_pss_rsae_sha256);
2929
public static final SignatureAndHashAlgorithm rsa_pss_rsae_sha384 =

‎tls/src/main/java/org/bouncycastle/tls/SignatureScheme.java‎

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,16 @@ public class SignatureScheme
4848
/*
4949
* draft-ietf-tls-mldsa-00
5050
*/
51-
public static final int DRAFT_mldsa44 = 0x0904;
52-
public static final int DRAFT_mldsa65 = 0x0905;
53-
public static final int DRAFT_mldsa87 = 0x0906;
51+
public static final int mldsa44 = 0x0904;
52+
public static final int mldsa65 = 0x0905;
53+
public static final int mldsa87 = 0x0906;
54+
55+
/** @deprecated Use 'mldsa44' instead. */
56+
public static final int DRAFT_mldsa44 = mldsa44;
57+
/** @deprecated Use 'mldsa65' instead. */
58+
public static final int DRAFT_mldsa65 = mldsa65;
59+
/** @deprecated Use 'mldsa87' instead. */
60+
public static final int DRAFT_mldsa87 = mldsa87;
5461

5562
/*
5663
* RFC 8446 reserved for private use (0xFE00..0xFFFF)
@@ -77,9 +84,9 @@ public static int getCryptoHashAlgorithm(int signatureScheme)
7784
{
7885
case ed25519:
7986
case ed448:
80-
case DRAFT_mldsa44:
81-
case DRAFT_mldsa65:
82-
case DRAFT_mldsa87:
87+
case mldsa44:
88+
case mldsa65:
89+
case mldsa87:
8390
return -1;
8491
case ecdsa_brainpoolP256r1tls13_sha256:
8592
case rsa_pss_pss_sha256:
@@ -156,12 +163,12 @@ public static String getName(int signatureScheme)
156163
return "ecdsa_brainpoolP512r1tls13_sha512";
157164
case sm2sig_sm3:
158165
return "sm2sig_sm3";
159-
case DRAFT_mldsa44:
160-
return "DRAFT_mldsa44";
161-
case DRAFT_mldsa65:
162-
return "DRAFT_mldsa65";
163-
case DRAFT_mldsa87:
164-
return "DRAFT_mldsa87";
166+
case mldsa44:
167+
return "mldsa44";
168+
case mldsa65:
169+
return "mldsa65";
170+
case mldsa87:
171+
return "mldsa87";
165172
default:
166173
return "UNKNOWN";
167174
}
@@ -233,12 +240,12 @@ public static SignatureAndHashAlgorithm getSignatureAndHashAlgorithm(int signatu
233240
return SignatureAndHashAlgorithm.ed25519;
234241
case ed448:
235242
return SignatureAndHashAlgorithm.ed448;
236-
case DRAFT_mldsa44:
237-
return SignatureAndHashAlgorithm.DRAFT_mldsa44;
238-
case DRAFT_mldsa65:
239-
return SignatureAndHashAlgorithm.DRAFT_mldsa65;
240-
case DRAFT_mldsa87:
241-
return SignatureAndHashAlgorithm.DRAFT_mldsa87;
243+
case mldsa44:
244+
return SignatureAndHashAlgorithm.mldsa44;
245+
case mldsa65:
246+
return SignatureAndHashAlgorithm.mldsa65;
247+
case mldsa87:
248+
return SignatureAndHashAlgorithm.mldsa87;
242249
default:
243250
return SignatureAndHashAlgorithm.getInstance(
244251
getHashAlgorithm(signatureScheme),
@@ -273,9 +280,9 @@ public static boolean isMLDSA(int signatureScheme)
273280
{
274281
switch (signatureScheme)
275282
{
276-
case DRAFT_mldsa44:
277-
case DRAFT_mldsa65:
278-
case DRAFT_mldsa87:
283+
case mldsa44:
284+
case mldsa65:
285+
case mldsa87:
279286
return true;
280287
default:
281288
return false;

‎tls/src/main/java/org/bouncycastle/tls/TlsUtils.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,9 +116,9 @@ private static Hashtable createCertSigAlgOIDs()
116116
addCertSigAlgOID(h, EdECObjectIdentifiers.id_Ed25519, SignatureAndHashAlgorithm.ed25519);
117117
addCertSigAlgOID(h, EdECObjectIdentifiers.id_Ed448, SignatureAndHashAlgorithm.ed448);
118118

119-
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_44, SignatureAndHashAlgorithm.DRAFT_mldsa44);
120-
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_65, SignatureAndHashAlgorithm.DRAFT_mldsa65);
121-
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_87, SignatureAndHashAlgorithm.DRAFT_mldsa87);
119+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_44, SignatureAndHashAlgorithm.mldsa44);
120+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_65, SignatureAndHashAlgorithm.mldsa65);
121+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_87, SignatureAndHashAlgorithm.mldsa87);
122122

123123
addCertSigAlgOID(h, RosstandartObjectIdentifiers.id_tc26_signwithdigest_gost_3410_12_256,
124124
SignatureAndHashAlgorithm.gostr34102012_256);

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/PQCUtil.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ public static ASN1ObjectIdentifier getMLDSAObjectidentifier(int signatureScheme)
1212
{
1313
switch (signatureScheme)
1414
{
15-
case SignatureScheme.DRAFT_mldsa44:
15+
case SignatureScheme.mldsa44:
1616
return NISTObjectIdentifiers.id_ml_dsa_44;
17-
case SignatureScheme.DRAFT_mldsa65:
17+
case SignatureScheme.mldsa65:
1818
return NISTObjectIdentifiers.id_ml_dsa_65;
19-
case SignatureScheme.DRAFT_mldsa87:
19+
case SignatureScheme.mldsa87:
2020
return NISTObjectIdentifiers.id_ml_dsa_87;
2121
default:
2222
throw new IllegalArgumentException();
@@ -27,15 +27,15 @@ public static int getMLDSASignatureScheme(MLDSAParameters parameters)
2727
{
2828
if (MLDSAParameters.ml_dsa_44 == parameters)
2929
{
30-
return SignatureScheme.DRAFT_mldsa44;
30+
return SignatureScheme.mldsa44;
3131
}
3232
if (MLDSAParameters.ml_dsa_65 == parameters)
3333
{
34-
return SignatureScheme.DRAFT_mldsa65;
34+
return SignatureScheme.mldsa65;
3535
}
3636
if (MLDSAParameters.ml_dsa_87 == parameters)
3737
{
38-
return SignatureScheme.DRAFT_mldsa87;
38+
return SignatureScheme.mldsa87;
3939
}
4040
throw new IllegalArgumentException();
4141
}

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsCrypto.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -457,10 +457,9 @@ public boolean hasSignatureAndHashAlgorithm(SignatureAndHashAlgorithm sigAndHash
457457
int signatureScheme = SignatureScheme.from(sigAndHashAlgorithm);
458458
if (SignatureScheme.isMLDSA(signatureScheme))
459459
{
460-
// TODO[tls-mldsa] Finish ML-DSA support before enabling
461-
return false;
460+
return true;
462461
}
463-
462+
464463
short signature = sigAndHashAlgorithm.getSignature();
465464

466465
switch (sigAndHashAlgorithm.getHash())
@@ -478,11 +477,10 @@ public boolean hasSignatureScheme(int signatureScheme)
478477
{
479478
case SignatureScheme.sm2sig_sm3:
480479
return false;
481-
case SignatureScheme.DRAFT_mldsa44:
482-
case SignatureScheme.DRAFT_mldsa65:
483-
case SignatureScheme.DRAFT_mldsa87:
484-
// TODO[tls-mldsa] Finish ML-DSA support before enabling
485-
return false;
480+
case SignatureScheme.mldsa44:
481+
case SignatureScheme.mldsa65:
482+
case SignatureScheme.mldsa87:
483+
return true;
486484
default:
487485
{
488486
short signature = SignatureScheme.getSignatureAlgorithm(signatureScheme);

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsRawKeyCertificate.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -250,9 +250,9 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException
250250
// return new BcTls13Verifier(verifier);
251251
// }
252252

253-
case SignatureScheme.DRAFT_mldsa44:
254-
case SignatureScheme.DRAFT_mldsa65:
255-
case SignatureScheme.DRAFT_mldsa87:
253+
case SignatureScheme.mldsa44:
254+
case SignatureScheme.mldsa65:
255+
case SignatureScheme.mldsa87:
256256
{
257257
ASN1ObjectIdentifier mlDsaAlgOid = PQCUtil.getMLDSAObjectidentifier(signatureScheme);
258258
validateMLDSA(mlDsaAlgOid);

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaDefaultTlsCredentialedSigner.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,15 @@ else if ("Ed448".equalsIgnoreCase(algorithm))
6868
}
6969
else if ("ML-DSA-44".equalsIgnoreCase(algorithm))
7070
{
71-
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.DRAFT_mldsa44);
71+
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.mldsa44);
7272
}
7373
else if ("ML-DSA-65".equalsIgnoreCase(algorithm))
7474
{
75-
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.DRAFT_mldsa65);
75+
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.mldsa65);
7676
}
7777
else if ("ML-DSA-87".equalsIgnoreCase(algorithm))
7878
{
79-
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.DRAFT_mldsa87);
79+
signer = new JcaTlsMLDSASigner(crypto, privateKey, SignatureScheme.mldsa87);
8080
}
8181
else
8282
{

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCertificate.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -274,9 +274,9 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException
274274
// TODO[RFC 8998]
275275
// case SignatureScheme.sm2sig_sm3:
276276

277-
case SignatureScheme.DRAFT_mldsa44:
278-
case SignatureScheme.DRAFT_mldsa65:
279-
case SignatureScheme.DRAFT_mldsa87:
277+
case SignatureScheme.mldsa44:
278+
case SignatureScheme.mldsa65:
279+
case SignatureScheme.mldsa87:
280280
return crypto.createTls13Verifier("ML-DSA", null, getPubKeyMLDSA());
281281

282282
default:

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCrypto.java‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -775,8 +775,7 @@ public boolean hasSignatureAndHashAlgorithm(SignatureAndHashAlgorithm sigAndHash
775775
int signatureScheme = SignatureScheme.from(sigAndHashAlgorithm);
776776
if (SignatureScheme.isMLDSA(signatureScheme))
777777
{
778-
// TODO[tls-mldsa] Finish ML-DSA support before enabling
779-
return false;
778+
return true;
780779
}
781780

782781
short signature = sigAndHashAlgorithm.getSignature();
@@ -799,11 +798,10 @@ public boolean hasSignatureScheme(int signatureScheme)
799798
{
800799
case SignatureScheme.sm2sig_sm3:
801800
return false;
802-
case SignatureScheme.DRAFT_mldsa44:
803-
case SignatureScheme.DRAFT_mldsa65:
804-
case SignatureScheme.DRAFT_mldsa87:
805-
// TODO[tls-mldsa] Finish ML-DSA support before enabling
806-
return false;
801+
case SignatureScheme.mldsa44:
802+
case SignatureScheme.mldsa65:
803+
case SignatureScheme.mldsa87:
804+
return true;
807805
default:
808806
{
809807
short signature = SignatureScheme.getSignatureAlgorithm(signatureScheme);

0 commit comments

Comments
 (0)