Skip to content

Commit 62c20ed

Browse files
antoinelochetAntoine Lochet
andauthored
Added PKCS#11 3.2 ML-DSA support in lib: (#809)
- OpenSSL >= 3.5 only - Hedge variants supported. - Tests with tests vectors - Multiple-part signature/verify not supported Co-authored-by: Antoine Lochet <antoine.2.lochet@atos.net>
1 parent ed00fb2 commit 62c20ed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+3919
-59
lines changed

.github/workflows/ci.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,46 @@ jobs:
7575
run: |
7676
make check || (find . -name test-suite.log -exec cat {} \; && false)
7777
78+
linux_ossl_35:
79+
name: Linux with OpenSSL 3.5.5
80+
runs-on: ubuntu-24.04
81+
steps:
82+
- uses: actions/checkout@v4
83+
- name: Prepare
84+
env:
85+
OPENSSL_VERSION: 3.5.5
86+
OPENSSL_SHA256: "b28c91532a8b65a1f983b4c28b7488174e4a01008e29ce8e69bd789f28bc2a89"
87+
OPENSSL_INSTALL_DIR: /usr/local/openssl-3.5
88+
LDFLAGS: "-Wl,-rpath,/usr/local/openssl-3.5/lib64 -L/usr/local/openssl-3.5/lib64"
89+
PKG_CONFIG_PATH: "/usr/local/openssl-3.5/lib64/pkgconfig"
90+
run: |
91+
sudo apt-get update -qq
92+
sudo apt-get install -y libcppunit-dev p11-kit build-essential checkinstall zlib1g-dev sudo autoconf libtool git
93+
# Install OpenSSL 3.5
94+
curl -L -O https://github.com/openssl/openssl/releases/download/openssl-${{ env.OPENSSL_VERSION }}/openssl-${{ env.OPENSSL_VERSION }}.tar.gz
95+
echo "${OPENSSL_SHA256} openssl-${{ env.OPENSSL_VERSION }}.tar.gz" | sha256sum -c -
96+
tar -xf openssl-${{ env.OPENSSL_VERSION }}.tar.gz
97+
cd openssl-${{ env.OPENSSL_VERSION }}
98+
./config shared zlib no-ssl3 no-weak-ssl-ciphers --prefix=${{ env.OPENSSL_INSTALL_DIR }} --openssldir=${{ env.OPENSSL_INSTALL_DIR }}
99+
make -j$(nproc) > build.log
100+
sudo make install > install.log
101+
cd ${{ env.OPENSSL_INSTALL_DIR }}
102+
sudo ln -sf lib64 lib
103+
- name: Build
104+
env:
105+
# Once all OpenSSL deprecations fixed, uncomment this
106+
# CXXFLAGS: -Werror
107+
OPENSSL_INSTALL_DIR: /usr/local/openssl-3.5
108+
LDFLAGS: "-Wl,-rpath,/usr/local/openssl-3.5/lib64 -L/usr/local/openssl-3.5/lib64"
109+
PKG_CONFIG_PATH: "/usr/local/openssl-3.5/lib64/pkgconfig"
110+
run: |
111+
./autogen.sh
112+
./configure --with-crypto-backend=openssl --with-openssl=${{ env.OPENSSL_INSTALL_DIR }}
113+
make -j$(nproc)
114+
- name: Test
115+
run: |
116+
make check || (find . -name test-suite.log -exec cat {} \; && false)
117+
78118
macos:
79119
name: macOS (${{ matrix.backend }})
80120
runs-on: macos-14

CMAKE-NOTES.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Some options (more can be found in CMakeLists.txt):
1111
-DBUILD_TESTS=ON Compile tests along with libraries
1212
-DDISABLE_NON_PAGED_MEMORY=ON Disable non-paged memory for secure storage
1313
-DENABLE_EDDSA=ON Enable support for EDDSA
14+
-DENABLE_MLDSA=ON Enable support for ML-DSA
1415
-DWITH_MIGRATE=ON Build migration tool
1516
-DWITH_CRYPTO_BACKEND=openssl Select crypto backend (openssl|botan)
1617

CMAKE-WIN-NOTES.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ Some options (more can be found in CMakeLists.txt):
5252

5353
-DBUILD_TESTS=ON Compile tests along with libraries
5454
-DENABLE_EDDSA=ON Enable support for EDDSA
55+
-DENABLE_MLDSA=ON Enable support for ML-DSA
5556
-DWITH_MIGRATE=ON Build migration tool
5657
-DWITH_CRYPTO_BACKEND= Select crypto backend (openssl|botan)
5758
-DDISABLE_NON_PAGED_MEMORY=ON Disable non-paged memory for secure storage

CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ option(DISABLE_VISIBILITY "Disables and unsets -fvisibility=hidden" OFF)
88
option(ENABLE_64bit "Enable 64-bit compiling" OFF)
99
option(ENABLE_ECC "Enable support for ECC" ON)
1010
option(ENABLE_EDDSA "Enable support for EDDSA" ON)
11+
option(ENABLE_MLDSA "Enable support for ML-DSA" OFF)
1112
option(ENABLE_GOST "Enable support for GOST" OFF)
1213
option(ENABLE_FIPS "Enable support for FIPS 140-2 mode" OFF)
1314
option(ENABLE_P11_KIT "Enable p11-kit integration" ON)

README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ Options:
8282
--enable-ecc Enable support for ECC (default detect)
8383
--enable-gost Enable support for GOST (default detect)
8484
--enable-eddsa Enable support for EDDSA (default detect)
85+
--enable-mldsa Enable support for ML-DSA (default detect)
8586
--disable-visibility Disable hidden visibilty link mode [enabled]
8687
--with-crypto-backend Select crypto backend (openssl|botan)
8788
--with-openssl=PATH Specify prefix of path of OpenSSL

config.h.in.cmake

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,9 @@
151151
/* Compile with EDDSA support */
152152
#cmakedefine WITH_EDDSA @WITH_EDDSA@
153153

154+
/* Compile with ML-DSA support */
155+
#cmakedefine WITH_ML_DSA @WITH_ML_DSA@
156+
154157
/* Compile with FIPS 140-2 mode */
155158
#cmakedefine WITH_FIPS @WITH_FIPS@
156159

m4/acx_crypto_backend.m4

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
2828
[enable_eddsa="detect"]
2929
)
3030
31+
# Add ML-DSA check
32+
33+
AC_ARG_ENABLE(mldsa,
34+
AS_HELP_STRING([--enable-mldsa],
35+
[Enable support for ML-DSA (default detect)]
36+
),
37+
[enable_mldsa="${enableval}"],
38+
[enable_mldsa="detect"]
39+
)
40+
3141
# Second check for the FIPS 140-2 mode
3242
3343
AC_ARG_ENABLE(fips,
@@ -100,6 +110,15 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
100110
detect*-no*) enable_eddsa="no";;
101111
esac
102112
113+
case "${enable_mldsa}" in
114+
yes|detect) ACX_OPENSSL_MLDSA;;
115+
esac
116+
case "${enable_mldsa}-${have_lib_openssl_mldsa_support}" in
117+
yes-no) AC_MSG_ERROR([OpenSSL library has no ML-DSA support]);;
118+
detect-yes) enable_mldsa="yes";;
119+
detect-no) enable_mldsa="no";;
120+
esac
121+
103122
case "${enable_gost}-${enable_fips}" in
104123
yes-yes) AC_MSG_ERROR([GOST is not FIPS approved]);;
105124
yes-no|detect-no) ACX_OPENSSL_GOST;;
@@ -166,6 +185,10 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
166185
detect-*) enable_eddsa="${have_lib_botan_eddsa_support}";;
167186
esac
168187
188+
if test "x${enable_mldsa}" = "xyes"; then
189+
AC_MSG_ERROR([Botan does not support ML-DSA])
190+
fi
191+
169192
case "${enable_gost}" in
170193
yes|detect) ACX_BOTAN_GOST;;
171194
esac
@@ -231,6 +254,19 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[
231254
fi
232255
AM_CONDITIONAL([WITH_EDDSA], [test "x${enable_eddsa}" = "xyes"])
233256
257+
AC_MSG_CHECKING(for ML-DSA support)
258+
if test "x${enable_mldsa}" = "xyes"; then
259+
AC_MSG_RESULT(yes)
260+
AC_DEFINE_UNQUOTED(
261+
[WITH_ML_DSA],
262+
[],
263+
[Compile with ML-DSA support]
264+
)
265+
else
266+
AC_MSG_RESULT(no)
267+
fi
268+
AM_CONDITIONAL([WITH_ML_DSA], [test "x${enable_mldsa}" = "xyes"])
269+
234270
235271
AC_SUBST(CRYPTO_INCLUDES)
236272
AC_SUBST(CRYPTO_LIBS)

m4/acx_openssl_mldsa.m4

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
AC_DEFUN([ACX_OPENSSL_MLDSA],[
2+
AC_MSG_CHECKING(for OpenSSL ML-DSA support)
3+
4+
tmp_CPPFLAGS=$CPPFLAGS
5+
tmp_LIBS=$LIBS
6+
7+
CPPFLAGS="$CPPFLAGS $CRYPTO_INCLUDES"
8+
LIBS="$CRYPTO_LIBS $LIBS"
9+
10+
AC_LANG_PUSH([C])
11+
AC_CACHE_VAL([acx_cv_lib_openssl_mldsa_support],[
12+
acx_cv_lib_openssl_mldsa_support=no
13+
AC_RUN_IFELSE([
14+
AC_LANG_SOURCE([[
15+
#include <openssl/evp.h>
16+
#include <openssl/objects.h>
17+
int main()
18+
{
19+
EVP_PKEY_CTX *pctx =
20+
EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
21+
if (pctx == NULL)
22+
return 1;
23+
return 0;
24+
}
25+
]])
26+
],[
27+
AC_MSG_RESULT([yes])
28+
acx_cv_lib_openssl_mldsa_support=yes
29+
],[
30+
AC_MSG_RESULT([no])
31+
acx_cv_lib_openssl_mldsa_support=no
32+
],[
33+
AC_MSG_WARN([Cannot test, ML-DSA])
34+
acx_cv_lib_openssl_mldsa_support=no
35+
])
36+
])
37+
38+
AC_LANG_POP([C])
39+
40+
CPPFLAGS=$tmp_CPPFLAGS
41+
LIBS=$tmp_LIBS
42+
have_lib_openssl_mldsa_support="${acx_cv_lib_openssl_mldsa_support}"
43+
])

src/bin/dump/tables.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ void fill_CKA_table(std::map<unsigned long, std::string> &t)
150150
t[CKA_OS_TOKENFLAGS] = "CKA_OS_TOKENFLAGS";
151151
t[CKA_OS_SOPIN] = "CKA_OS_SOPIN";
152152
t[CKA_OS_USERPIN] = "CKA_OS_USERPIN";
153+
t[CKA_PARAMETER_SET] = "CKA_PARAMETER_SET";
154+
t[CKA_SEED] = "CKA_SEED";
153155
}
154156

155157
void fill_CKM_table(std::map<unsigned long, std::string> &t)
@@ -478,6 +480,8 @@ void fill_CKM_table(std::map<unsigned long, std::string> &t)
478480
t[CKM_RSA_PKCS_OAEP_TPM_1_1] = "CKM_RSA_PKCS_OAEP_TPM_1_1";
479481
t[CKM_EC_EDWARDS_KEY_PAIR_GEN] = "CKM_EC_EDWARDS_KEY_PAIR_GEN";
480482
t[CKM_EDDSA] = "CKM_EDDSA";
483+
t[CKM_ML_DSA_KEY_PAIR_GEN] = "CKM_ML_DSA_KEY_PAIR_GEN";
484+
t[CKM_ML_DSA] = "CKM_ML_DSA";
481485
}
482486

483487
void fill_CKO_table(std::map<unsigned long, std::string> &t)
@@ -544,6 +548,7 @@ void fill_CKK_table(std::map<unsigned long, std::string> &t)
544548
t[CKK_GOSTR3411] = "CKK_GOSTR3411";
545549
t[CKK_GOST28147] = "CKK_GOST28147";
546550
t[CKK_EC_EDWARDS] = "CKK_EC_EDWARDS";
551+
t[CKK_ML_DSA] = "CKK_ML_DSA";
547552
}
548553

549554
void fill_CKC_table(std::map<unsigned long, std::string> &t)

src/lib/P11Attributes.cpp

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2227,6 +2227,38 @@ bool P11AttrEcPoint::setDefault()
22272227
return osobject->setAttribute(type, attr);
22282228
}
22292229

2230+
/*****************************************
2231+
* CKA_PARAMETER_SET
2232+
*****************************************/
2233+
2234+
// Set default value
2235+
bool P11AttrParameterSet::setDefault()
2236+
{
2237+
OSAttribute attr((unsigned long)0);
2238+
return osobject->setAttribute(type, attr);
2239+
}
2240+
2241+
// Update the value if allowed
2242+
CK_RV P11AttrParameterSet::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
2243+
{
2244+
// Attribute specific checks
2245+
if (op != OBJECT_OP_GENERATE && op != OBJECT_OP_CREATE)
2246+
{
2247+
return CKR_ATTRIBUTE_READ_ONLY;
2248+
}
2249+
2250+
if (ulValueLen != sizeof(CK_ULONG))
2251+
{
2252+
return CKR_ATTRIBUTE_VALUE_INVALID;
2253+
}
2254+
2255+
// Store data
2256+
2257+
osobject->setAttribute(type, *(CK_ULONG*)pValue);
2258+
2259+
return CKR_OK;
2260+
}
2261+
22302262
/*****************************************
22312263
* CKA_GOSTR3410_PARAMS
22322264
*****************************************/
@@ -2523,3 +2555,42 @@ CK_RV P11AttrAllowedMechanisms::updateAttr(Token* /*token*/, bool /*isPrivate*/,
25232555
osobject->setAttribute(type, OSAttribute(data));
25242556
return CKR_OK;
25252557
}
2558+
2559+
/*****************************************
2560+
* CKA_SEED
2561+
*****************************************/
2562+
2563+
// Set default value
2564+
bool P11AttrSeed::setDefault()
2565+
{
2566+
OSAttribute attr(ByteString(""));
2567+
return osobject->setAttribute(type, attr);
2568+
}
2569+
2570+
// Update the value if allowed
2571+
CK_RV P11AttrSeed::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
2572+
{
2573+
ByteString plaintext((unsigned char*)pValue, ulValueLen);
2574+
ByteString value;
2575+
2576+
// Encrypt
2577+
2578+
if (isPrivate)
2579+
{
2580+
if (!token->encrypt(plaintext, value))
2581+
return CKR_GENERAL_ERROR;
2582+
}
2583+
else
2584+
value = plaintext;
2585+
2586+
// Attribute specific checks
2587+
2588+
if (value.size() < ulValueLen)
2589+
return CKR_GENERAL_ERROR;
2590+
2591+
// Store data
2592+
2593+
osobject->setAttribute(type, value);
2594+
2595+
return CKR_OK;
2596+
}

0 commit comments

Comments
 (0)