Skip to content

Commit ec6f757

Browse files
peterdettmanpeterdettman
committed
tls-mldsa updates from testing
1 parent dcfff3d commit ec6f757

16 files changed

+104
-17
lines changed

‎tls/src/main/java/org/bouncycastle/tls/SignatureAndHashAlgorithm.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,15 @@ public class SignatureAndHashAlgorithm
1515
create(SignatureScheme.ecdsa_brainpoolP384r1tls13_sha384);
1616
public static final SignatureAndHashAlgorithm ecdsa_brainpoolP512r1tls13_sha512 =
1717
create(SignatureScheme.ecdsa_brainpoolP512r1tls13_sha512);
18-
public static final SignatureAndHashAlgorithm ed25519 =
19-
create(SignatureScheme.ed25519);
20-
public static final SignatureAndHashAlgorithm ed448 =
21-
create(SignatureScheme.ed448);
18+
public static final SignatureAndHashAlgorithm ed25519 = create(SignatureScheme.ed25519);
19+
public static final SignatureAndHashAlgorithm ed448 = create(SignatureScheme.ed448);
2220
public static final SignatureAndHashAlgorithm gostr34102012_256 =
2321
create(HashAlgorithm.Intrinsic, SignatureAlgorithm.gostr34102012_256);
2422
public static final SignatureAndHashAlgorithm gostr34102012_512 =
2523
create(HashAlgorithm.Intrinsic, SignatureAlgorithm.gostr34102012_512);
24+
public static final SignatureAndHashAlgorithm DRAFT_mldsa44 = create(SignatureScheme.DRAFT_mldsa44);
25+
public static final SignatureAndHashAlgorithm DRAFT_mldsa65 = create(SignatureScheme.DRAFT_mldsa65);
26+
public static final SignatureAndHashAlgorithm DRAFT_mldsa87 = create(SignatureScheme.DRAFT_mldsa87);
2627
public static final SignatureAndHashAlgorithm rsa_pss_rsae_sha256 =
2728
create(SignatureScheme.rsa_pss_rsae_sha256);
2829
public static final SignatureAndHashAlgorithm rsa_pss_rsae_sha384 =

‎tls/src/main/java/org/bouncycastle/tls/SignatureScheme.java‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -227,9 +227,23 @@ public static short getSignatureAlgorithm(int signatureScheme)
227227

228228
public static SignatureAndHashAlgorithm getSignatureAndHashAlgorithm(int signatureScheme)
229229
{
230-
return SignatureAndHashAlgorithm.getInstance(
231-
getHashAlgorithm(signatureScheme),
232-
getSignatureAlgorithm(signatureScheme));
230+
switch (signatureScheme)
231+
{
232+
case ed25519:
233+
return SignatureAndHashAlgorithm.ed25519;
234+
case ed448:
235+
return SignatureAndHashAlgorithm.ed448;
236+
case DRAFT_mldsa44:
237+
return SignatureAndHashAlgorithm.DRAFT_mldsa44;
238+
case DRAFT_mldsa65:
239+
return SignatureAndHashAlgorithm.DRAFT_mldsa65;
240+
case DRAFT_mldsa87:
241+
return SignatureAndHashAlgorithm.DRAFT_mldsa87;
242+
default:
243+
return SignatureAndHashAlgorithm.getInstance(
244+
getHashAlgorithm(signatureScheme),
245+
getSignatureAlgorithm(signatureScheme));
246+
}
233247
}
234248

235249
public static String getText(int signatureScheme)

‎tls/src/main/java/org/bouncycastle/tls/TlsUtils.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public class TlsUtils
6363
// Map OID strings to HashAlgorithm values
6464
private static final Hashtable CERT_SIG_ALG_OIDS = createCertSigAlgOIDs();
6565
private static final Vector DEFAULT_SUPPORTED_SIG_ALGS = createDefaultSupportedSigAlgs();
66-
66+
6767
private static void addCertSigAlgOID(Hashtable h, ASN1ObjectIdentifier oid, SignatureAndHashAlgorithm sigAndHash)
6868
{
6969
h.put(oid.getId(), sigAndHash);
@@ -116,6 +116,10 @@ private static Hashtable createCertSigAlgOIDs()
116116
addCertSigAlgOID(h, EdECObjectIdentifiers.id_Ed25519, SignatureAndHashAlgorithm.ed25519);
117117
addCertSigAlgOID(h, EdECObjectIdentifiers.id_Ed448, SignatureAndHashAlgorithm.ed448);
118118

119+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_44, SignatureAndHashAlgorithm.DRAFT_mldsa44);
120+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_65, SignatureAndHashAlgorithm.DRAFT_mldsa65);
121+
addCertSigAlgOID(h, NISTObjectIdentifiers.id_ml_dsa_87, SignatureAndHashAlgorithm.DRAFT_mldsa87);
122+
119123
addCertSigAlgOID(h, RosstandartObjectIdentifiers.id_tc26_signwithdigest_gost_3410_12_256,
120124
SignatureAndHashAlgorithm.gostr34102012_256);
121125
addCertSigAlgOID(h, RosstandartObjectIdentifiers.id_tc26_signwithdigest_gost_3410_12_512,

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsCrypto.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,13 @@ public boolean hasSignatureAlgorithm(short signatureAlgorithm)
454454

455455
public boolean hasSignatureAndHashAlgorithm(SignatureAndHashAlgorithm sigAndHashAlgorithm)
456456
{
457+
int signatureScheme = SignatureScheme.from(sigAndHashAlgorithm);
458+
if (SignatureScheme.isMLDSA(signatureScheme))
459+
{
460+
// TODO[tls-mldsa] Finish ML-DSA support before enabling
461+
return false;
462+
}
463+
457464
short signature = sigAndHashAlgorithm.getSignature();
458465

459466
switch (sigAndHashAlgorithm.getHash())
@@ -470,10 +477,11 @@ public boolean hasSignatureScheme(int signatureScheme)
470477
switch (signatureScheme)
471478
{
472479
case SignatureScheme.sm2sig_sm3:
473-
// TODO[tls] Test coverage before adding
480+
return false;
474481
case SignatureScheme.DRAFT_mldsa44:
475482
case SignatureScheme.DRAFT_mldsa65:
476483
case SignatureScheme.DRAFT_mldsa87:
484+
// TODO[tls-mldsa] Finish ML-DSA support before enabling
477485
return false;
478486
default:
479487
{

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCrypto.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -772,6 +772,13 @@ public boolean hasSignatureAlgorithm(short signatureAlgorithm)
772772

773773
public boolean hasSignatureAndHashAlgorithm(SignatureAndHashAlgorithm sigAndHashAlgorithm)
774774
{
775+
int signatureScheme = SignatureScheme.from(sigAndHashAlgorithm);
776+
if (SignatureScheme.isMLDSA(signatureScheme))
777+
{
778+
// TODO[tls-mldsa] Finish ML-DSA support before enabling
779+
return false;
780+
}
781+
775782
short signature = sigAndHashAlgorithm.getSignature();
776783

777784
switch (sigAndHashAlgorithm.getHash())
@@ -791,10 +798,11 @@ public boolean hasSignatureScheme(int signatureScheme)
791798
switch (signatureScheme)
792799
{
793800
case SignatureScheme.sm2sig_sm3:
794-
// TODO[tls] Implement before adding
801+
return false;
795802
case SignatureScheme.DRAFT_mldsa44:
796803
case SignatureScheme.DRAFT_mldsa65:
797804
case SignatureScheme.DRAFT_mldsa87:
805+
// TODO[tls-mldsa] Finish ML-DSA support before enabling
798806
return false;
799807
default:
800808
{

‎tls/src/test/java/org/bouncycastle/tls/test/MockDTLSClient.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ public void notifyServerCertificate(TlsServerCertificate serverCertificate) thro
110110

111111
String[] trustedCertResources = new String[]{ "x509-server-dsa.pem", "x509-server-ecdh.pem",
112112
"x509-server-ecdsa.pem", "x509-server-ed25519.pem", "x509-server-ed448.pem",
113+
"x509-server-ml_dsa_44.pem", "x509-server-ml_dsa_65.pem", "x509-server-ml_dsa_87.pem",
113114
"x509-server-rsa_pss_256.pem", "x509-server-rsa_pss_384.pem", "x509-server-rsa_pss_512.pem",
114115
"x509-server-rsa-enc.pem", "x509-server-rsa-sign.pem" };
115116

‎tls/src/test/java/org/bouncycastle/tls/test/MockDTLSServer.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,8 @@ public void notifyClientCertificate(org.bouncycastle.tls.Certificate clientCerti
112112
}
113113

114114
String[] trustedCertResources = new String[]{ "x509-client-dsa.pem", "x509-client-ecdh.pem",
115-
"x509-client-ecdsa.pem", "x509-client-ed25519.pem", "x509-client-ed448.pem", "x509-client-rsa_pss_256.pem",
115+
"x509-client-ecdsa.pem", "x509-client-ed25519.pem", "x509-client-ed448.pem", "x509-client-ml_dsa_44.pem",
116+
"x509-client-ml_dsa_65.pem", "x509-client-ml_dsa_87.pem", "x509-client-rsa_pss_256.pem",
116117
"x509-client-rsa_pss_384.pem", "x509-client-rsa_pss_512.pem", "x509-client-rsa.pem" };
117118

118119
TlsCertificate[] certPath = TlsTestUtils.getTrustedCertPath(context.getCrypto(), chain[0],

‎tls/src/test/java/org/bouncycastle/tls/test/MockTlsClient.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ public void notifyServerCertificate(TlsServerCertificate serverCertificate) thro
128128

129129
String[] trustedCertResources = new String[]{ "x509-server-dsa.pem", "x509-server-ecdh.pem",
130130
"x509-server-ecdsa.pem", "x509-server-ed25519.pem", "x509-server-ed448.pem",
131+
"x509-server-ml_dsa_44.pem", "x509-server-ml_dsa_65.pem", "x509-server-ml_dsa_87.pem",
131132
"x509-server-rsa_pss_256.pem", "x509-server-rsa_pss_384.pem", "x509-server-rsa_pss_512.pem",
132133
"x509-server-rsa-enc.pem", "x509-server-rsa-sign.pem" };
133134

‎tls/src/test/java/org/bouncycastle/tls/test/MockTlsHybridClient.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ public void notifyServerCertificate(TlsServerCertificate serverCertificate) thro
154154

155155
String[] trustedCertResources = new String[]{ "x509-server-dsa.pem", "x509-server-ecdh.pem",
156156
"x509-server-ecdsa.pem", "x509-server-ed25519.pem", "x509-server-ed448.pem",
157+
"x509-server-ml_dsa_44.pem", "x509-server-ml_dsa_65.pem", "x509-server-ml_dsa_87.pem",
157158
"x509-server-rsa_pss_256.pem", "x509-server-rsa_pss_384.pem", "x509-server-rsa_pss_512.pem",
158159
"x509-server-rsa-enc.pem", "x509-server-rsa-sign.pem" };
159160

‎tls/src/test/java/org/bouncycastle/tls/test/MockTlsHybridServer.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,8 @@ public void notifyClientCertificate(org.bouncycastle.tls.Certificate clientCerti
162162
}
163163

164164
String[] trustedCertResources = new String[]{ "x509-client-dsa.pem", "x509-client-ecdh.pem",
165-
"x509-client-ecdsa.pem", "x509-client-ed25519.pem", "x509-client-ed448.pem", "x509-client-rsa_pss_256.pem",
165+
"x509-client-ecdsa.pem", "x509-client-ed25519.pem", "x509-client-ed448.pem", "x509-client-ml_dsa_44.pem",
166+
"x509-client-ml_dsa_65.pem", "x509-client-ml_dsa_87.pem", "x509-client-rsa_pss_256.pem",
166167
"x509-client-rsa_pss_384.pem", "x509-client-rsa_pss_512.pem", "x509-client-rsa.pem" };
167168

168169
TlsCertificate[] certPath = TlsTestUtils.getTrustedCertPath(context.getCrypto(), chain[0],

0 commit comments

Comments
 (0)