Skip to content

See if we can add OSSL_FUNC_SIGNATURE_digest_sign support for ML-DSA #640

@simo5

Description

@simo5

Unfortunately this is a problem deep into EVP_DigestSign().
openssl req calls: do_X509_REQ_sign() which calls X509_REQ_sign_ctx which calls ASN1_item_sign_ctx which ultimately calls EVP_DigestSign and this function fallbacks to EVP_DigestSignUpdate() + EVP_DigestSignFinal() because we do not have a digest_sign interaface internally.

I do not recall why we didn't add it, it may be due to the fact that technically ML-DSA does not allow what is traditionally a digest_sign API for OpenSSL as you can't select the digest for ML-DSA signatures.

I'll use this investigation to open a bug to see if we can add it safely w/o breaking other assumptions in OpenSSL.

Originally posted by @simo5 in #638 (reply in thread)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions