Post-quantum certificate support (ML-DSA-87 + ML-KEM-1024)#5
Merged
disentangle-network merged 1 commit intomasterfrom Feb 19, 2026
Merged
Post-quantum certificate support (ML-DSA-87 + ML-KEM-1024)#5disentangle-network merged 1 commit intomasterfrom
disentangle-network merged 1 commit intomasterfrom
Conversation
Add Curve_PQ (value 2) to the Curve enum for post-quantum certificates using NIST FIPS 204 (ML-DSA-87) for signing and FIPS 203 (ML-KEM-1024) for key agreement. V2 ASN.1 certificate format handles variable-length keys natively. Crypto surface changes: - cert/sign.go: ML-DSA-87 sign via cloudflare/circl - cert/cert_v2.go: ML-DSA-87 verify, ML-KEM-1024 key pair verification - cert/pem.go: MLDSA87 and MLKEM1024 PEM banners for all key types - cert/crypto.go: encrypted PQ private key support - cert/helper_test.go: PQ CA keygen (ML-DSA-87) and host keygen (ML-KEM-1024) Key sizes: - ML-DSA-87 public key: 2592 bytes, signature: 4627 bytes - ML-KEM-1024 public key: 1568 bytes Tests: - TestCertificateV2_SignPQ: CA cert sign/verify/marshal/unmarshal roundtrip - TestCertificateV2_SignPQ_HostCert: CA-signed host cert with ML-KEM-1024 key - All 38 existing cert tests pass (zero regressions) Dependency: github.com/cloudflare/circl v1.6.3 (FIPS-aligned PQ crypto)
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Curve_PQ(value 2) to the Curve enum for post-quantum certificatesKey sizes
Test plan