Add PQC certificate support for HTTPS (#62866)

Author: MackinnonBuck

src/Servers/Kestrel/Core/src/Internal/Certificates/CertificateConfigLoader.cs

@@ -1,6 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
@@ -96,6 +97,23 @@ private static X509Certificate2 LoadCertificateKey(X509Certificate2 certificate,
         const string DSAOid = "1.2.840.10040.4.1";
         const string ECDsaOid = "1.2.840.10045.2.1";
 
+        const string MLDsa44Oid = "2.16.840.1.101.3.4.3.17";
+        const string MLDsa65Oid = "2.16.840.1.101.3.4.3.18";
+        const string MLDsa87Oid = "2.16.840.1.101.3.4.3.19";
+
+        const string SlhDsaSha2_128sOid = "2.16.840.1.101.3.4.3.20";
+        const string SlhDsaSha2_128fOid = "2.16.840.1.101.3.4.3.21";
+        const string SlhDsaSha2_192sOid = "2.16.840.1.101.3.4.3.22";
+        const string SlhDsaSha2_192fOid = "2.16.840.1.101.3.4.3.23";
+        const string SlhDsaSha2_256sOid = "2.16.840.1.101.3.4.3.24";
+        const string SlhDsaSha2_256fOid = "2.16.840.1.101.3.4.3.25";
+        const string SlhDsaShake_128sOid = "2.16.840.1.101.3.4.3.26";
+        const string SlhDsaShake_128fOid = "2.16.840.1.101.3.4.3.27";
+        const string SlhDsaShake_192sOid = "2.16.840.1.101.3.4.3.28";
+        const string SlhDsaShake_192fOid = "2.16.840.1.101.3.4.3.29";
+        const string SlhDsaShake_256sOid = "2.16.840.1.101.3.4.3.30";
+        const string SlhDsaShake_256fOid = "2.16.840.1.101.3.4.3.31";
+
         // Duplication is required here because there are separate CopyWithPrivateKey methods for each algorithm.
         var keyText = File.ReadAllText(keyPath);
         switch (certificate.PublicKey.Oid.Value)
@@ -142,6 +160,47 @@ private static X509Certificate2 LoadCertificateKey(X509Certificate2 certificate,
                         throw CreateErrorGettingPrivateKeyException(keyPath, ex);
                     }
                 }
+            case MLDsa44Oid:
+            case MLDsa65Oid:
+            case MLDsa87Oid:
+                {
+#pragma warning disable SYSLIB5006 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
+                    using var mlDsa = ImportMLDsaKeyFromFile(keyText, password);
+
+                    try
+                    {
+                        return certificate.CopyWithPrivateKey(mlDsa);
+                    }
+                    catch (Exception ex)
+                    {
+                        throw CreateErrorGettingPrivateKeyException(keyPath, ex);
+                    }
+                }
+            case SlhDsaSha2_128sOid:
+            case SlhDsaSha2_128fOid:
+            case SlhDsaSha2_192sOid:
+            case SlhDsaSha2_192fOid:
+            case SlhDsaSha2_256sOid:
+            case SlhDsaSha2_256fOid:
+            case SlhDsaShake_128sOid:
+            case SlhDsaShake_128fOid:
+            case SlhDsaShake_192sOid:
+            case SlhDsaShake_192fOid:
+            case SlhDsaShake_256sOid:
+            case SlhDsaShake_256fOid:
+                {
+                    using var slhDsa = ImportSlhDsaKeyFromFile(keyText, password);
+
+                    try
+                    {
+                        return certificate.CopyWithPrivateKey(slhDsa);
+                    }
+                    catch (Exception ex)
+                    {
+                        throw CreateErrorGettingPrivateKeyException(keyPath, ex);
+                    }
+                }
+#pragma warning restore SYSLIB5006 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
             default:
                 throw new InvalidOperationException(string.Format(CultureInfo.InvariantCulture, CoreStrings.UnrecognizedCertificateKeyOid, certificate.PublicKey.Oid.Value));
         }
@@ -174,6 +233,32 @@ private static void ImportKeyFromFile(AsymmetricAlgorithm asymmetricAlgorithm, s
         }
     }
 
+    [Experimental("SYSLIB5006")]
+    private static MLDsa ImportMLDsaKeyFromFile(string keyText, string? password)
+    {
+        if (password == null)
+        {
+            return MLDsa.ImportFromPem(keyText);
+        }
+        else
+        {
+            return MLDsa.ImportFromEncryptedPem(keyText, password);
+        }
+    }
+
+    [Experimental("SYSLIB5006")]
+    private static SlhDsa ImportSlhDsaKeyFromFile(string keyText, string? password)
+    {
+        if (password == null)
+        {
+            return SlhDsa.ImportFromPem(keyText);
+        }
+        else
+        {
+            return SlhDsa.ImportFromEncryptedPem(keyText, password);
+        }
+    }
+
     private static X509Certificate2 LoadFromStoreCert(CertificateConfig certInfo)
     {
         var subject = certInfo.Subject!;