Add unstable support for ML-DSA algorithms

Author: djc

.github/workflows/ci.yml

@@ -27,12 +27,15 @@ jobs:
               with:
                   components: clippy, rustfmt
             - run: cargo fmt -- --check
-            - run: cargo clippy --all-features --all-targets
+            # `fips` and `aws_lc_rs_unstable` cannot be used together, so avoid `--all-features`
+            - run: cargo clippy --features ring,pem,x509-parser --all-targets
             # rustls-cert-gen require either aws_lc_rs or ring feature
             - run: cargo clippy -p rcgen --no-default-features --all-targets
             - run: cargo clippy --no-default-features --features ring --all-targets
+            - run: cargo clippy --no-default-features --features aws_lc_rs,pem,x509-parser --all-targets
+            - run: cargo clippy --no-default-features --features aws_lc_rs_unstable,pem,x509-parser --all-targets
             - run: cargo clippy --no-default-features --features aws_lc_rs --all-targets
-            - run: cargo clippy --no-default-features --features aws_lc_rs,pem --all-targets
+            - run: cargo clippy --no-default-features --features fips,pem,x509-parser --all-targets
 
     rustdoc:
         name: Documentation
@@ -49,8 +52,16 @@ jobs:
               uses: dtolnay/rust-toolchain@master
               with:
                   toolchain: ${{ matrix.toolchain }}
-            - name: cargo doc (all features)
-              run: cargo doc --all-features --document-private-items
+            - name: cargo doc (ring)
+              run: cargo doc --features ring,pem,x509-parser --document-private-items
+              env:
+                  RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=docsrs' || '-Dwarnings' }}
+            - name: cargo doc (aws_lc_rs_unstable)
+              run: cargo doc --features aws_lc_rs_unstable,pem,x509-parser --document-private-items
+              env:
+                  RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=docsrs' || '-Dwarnings' }}
+            - name: cargo doc (fips)
+              run: cargo doc --no-default-features --features fips --document-private-items
               env:
                   RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=docsrs' || '-Dwarnings' }}
 
@@ -70,7 +81,10 @@ jobs:
             - run: cargo install --locked cargo-check-external-types
             - name: run cargo-check-external-types for rcgen/
               working-directory: rcgen/
-              run: cargo check-external-types --all-features
+              run: cargo check-external-types --features ring,pem,x509-parser
+            - name: run cargo-check-external-types for rcgen/
+              working-directory: rcgen/
+              run: cargo check-external-types --features aws_lc_rs_unstable,pem,x509-parser
 
     semver:
         name: Check semver compatibility
@@ -94,7 +108,9 @@ jobs:
             - uses: dtolnay/rust-toolchain@master
               with:
                   toolchain: 1.71.0
-            - run: cargo check --locked --lib --all-features
+            - run: cargo check --locked --lib --features ring,pem,x509-parser
+            - run: cargo check --locked --lib --features aws_lc_rs_unstable
+            - run: cargo check --locked --lib --features fips
 
     build-windows:
         runs-on: windows-latest
@@ -214,7 +230,7 @@ jobs:
               with:
                   components: llvm-tools
             - name: Measure coverage
-              run: cargo llvm-cov --all-features --lcov --output-path ./lcov.info
+              run: cargo llvm-cov --features ring,pem,x509-parser --lcov --output-path ./lcov.info
             - name: Report to codecov.io
               uses: codecov/codecov-action@v5
               with:

Cargo.lock

@@ -14,7 +14,7 @@ keywords = ["mkcert", "ca", "certificate"]
 [workspace.dependencies]
 anyhow = "1.0.75"
 assert_fs = "1.0.13"
-aws-lc-rs = { version = "1.6.0", default-features = false }
+aws-lc-rs = { version = "1.13.3", default-features = false }
 botan = { version = "0.11", features = ["vendored"] }
 bpaf = { version = "0.9.5", features = ["derive"] }
 openssl = "0.10"

Cargo.toml

@@ -13,6 +13,7 @@ keywords.workspace = true
 [features]
 default = ["crypto", "pem", "ring"]
 aws_lc_rs = ["crypto", "dep:aws-lc-rs", "aws-lc-rs/aws-lc-sys"]
+aws_lc_rs_unstable = ["aws_lc_rs", "aws-lc-rs/unstable"]
 fips = ["crypto", "dep:aws-lc-rs", "aws-lc-rs/fips"]
 crypto = []
 ring = ["crypto", "dep:ring"]

rcgen/Cargo.toml

@@ -27,6 +27,8 @@ use crate::sign_algo::{algo::*, SignAlgo};
 #[cfg(feature = "pem")]
 use crate::ENCODE_CONFIG;
 use crate::{sign_algo::SignatureAlgorithm, Error};
+#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+use aws_lc_rs::unstable::signature::PqdsaKeyPair;
 
 /// A key pair variant
 #[allow(clippy::large_enum_variant)]
@@ -36,6 +38,9 @@ pub(crate) enum KeyPairKind {
 	Ec(EcdsaKeyPair),
 	/// A Ed25519 key pair
 	Ed(Ed25519KeyPair),
+	/// A Pqdsa key pair
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	Pq(PqdsaKeyPair),
 	/// A RSA key pair
 	Rsa(RsaKeyPair, &'static dyn RsaEncoding),
 }
@@ -46,6 +51,8 @@ impl fmt::Debug for KeyPairKind {
 		match self {
 			Self::Ec(key_pair) => write!(f, "{key_pair:?}"),
 			Self::Ed(key_pair) => write!(f, "{key_pair:?}"),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			Self::Pq(key_pair) => write!(f, "{key_pair:?}"),
 			Self::Rsa(key_pair, _) => write!(f, "{key_pair:?}"),
 		}
 	}
@@ -111,6 +118,17 @@ impl KeyPair {
 					serialized_der: key_pair_serialized,
 				})
 			},
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			SignAlgo::PqDsa(sign_alg) => {
+				let key_pair = PqdsaKeyPair::generate(sign_alg)._err()?;
+				let key_pair_serialized = key_pair.to_pkcs8()._err()?.as_ref().to_vec();
+
+				Ok(KeyPair {
+					kind: KeyPairKind::Pq(key_pair),
+					alg,
+					serialized_der: key_pair_serialized,
+				})
+			},
 			#[cfg(feature = "aws_lc_rs")]
 			SignAlgo::Rsa(sign_alg) => Self::generate_rsa_inner(alg, sign_alg, KeySize::Rsa2048),
 			// Ring doesn't have RSA key generation yet:
@@ -433,6 +451,12 @@ impl SigningKey for KeyPair {
 				signature.as_ref().to_owned()
 			},
 			KeyPairKind::Ed(kp) => kp.sign(msg).as_ref().to_owned(),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairKind::Pq(kp) => {
+				let mut signature = vec![0; kp.algorithm().signature_len()];
+				kp.sign(msg, &mut signature)._err()?;
+				signature
+			},
 			KeyPairKind::Rsa(kp, padding_alg) => {
 				let system_random = SystemRandom::new();
 				let mut signature = vec![0; rsa_key_pair_public_modulus_len(kp)];
@@ -450,6 +474,8 @@ impl PublicKeyData for KeyPair {
 		match &self.kind {
 			KeyPairKind::Ec(kp) => kp.public_key().as_ref(),
 			KeyPairKind::Ed(kp) => kp.public_key().as_ref(),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairKind::Pq(kp) => kp.public_key().as_ref(),
 			KeyPairKind::Rsa(kp, _) => kp.public_key().as_ref(),
 		}
 	}

rcgen/src/key_pair.rs

@@ -25,6 +25,13 @@ pub(crate) const EC_SECP_384_R1: &[u64] = &[1, 3, 132, 0, 34];
 #[cfg(feature = "aws_lc_rs")]
 pub(crate) const EC_SECP_521_R1: &[u64] = &[1, 3, 132, 0, 35];
 
+#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+pub(crate) const ML_DSA_44: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 17];
+#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+pub(crate) const ML_DSA_65: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 18];
+#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+pub(crate) const ML_DSA_87: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 19];
+
 /// rsaEncryption in [RFC 4055](https://www.rfc-editor.org/rfc/rfc4055#section-6)
 pub(crate) const RSA_ENCRYPTION: &[u64] = &[1, 2, 840, 113549, 1, 1, 1];
 

rcgen/src/oid.rs

@@ -8,12 +8,18 @@ use yasna::Tag;
 #[cfg(feature = "crypto")]
 use crate::ring_like::signature::{self, EcdsaSigningAlgorithm, EdDSAParameters, RsaEncoding};
 use crate::Error;
+#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+use aws_lc_rs::unstable::signature::{
+	PqdsaSigningAlgorithm, ML_DSA_44_SIGNING, ML_DSA_65_SIGNING, ML_DSA_87_SIGNING,
+};
 
 #[cfg(feature = "crypto")]
 #[derive(Clone, Copy, Debug)]
 pub(crate) enum SignAlgo {
 	EcDsa(&'static EcdsaSigningAlgorithm),
 	EdDsa(&'static EdDSAParameters),
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	PqDsa(&'static PqdsaSigningAlgorithm),
 	Rsa(&'static dyn RsaEncoding),
 }
 
@@ -209,6 +215,36 @@ pub(crate) mod algo {
 		oid_components: &[1, 3, 101, 112],
 		params: SignatureAlgorithmParams::None,
 	};
+
+	/// ML-DSA-44 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	pub static PKCS_ML_DSA_44: SignatureAlgorithm = SignatureAlgorithm {
+		oids_sign_alg: &[ML_DSA_44],
+		#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
+		sign_alg: SignAlgo::PqDsa(&ML_DSA_44_SIGNING),
+		oid_components: ML_DSA_44,
+		params: SignatureAlgorithmParams::None,
+	};
+
+	/// ML-DSA-44 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	pub static PKCS_ML_DSA_65: SignatureAlgorithm = SignatureAlgorithm {
+		oids_sign_alg: &[ML_DSA_65],
+		#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
+		sign_alg: SignAlgo::PqDsa(&ML_DSA_65_SIGNING),
+		oid_components: ML_DSA_65,
+		params: SignatureAlgorithmParams::None,
+	};
+
+	/// ML-DSA-44 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	pub static PKCS_ML_DSA_87: SignatureAlgorithm = SignatureAlgorithm {
+		oids_sign_alg: &[ML_DSA_87],
+		#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
+		sign_alg: SignAlgo::PqDsa(&ML_DSA_87_SIGNING),
+		oid_components: ML_DSA_87,
+		params: SignatureAlgorithmParams::None,
+	};
 }
 // Signature algorithm IDs as per https://tools.ietf.org/html/rfc4055
 impl SignatureAlgorithm {

rcgen/src/sign_algo.rs

@@ -13,6 +13,7 @@ keywords.workspace = true
 [features]
 default = ["ring"]
 aws_lc_rs = ["dep:aws-lc-rs", "rcgen/aws_lc_rs", "aws-lc-rs/aws-lc-sys"]
+aws_lc_rs_unstable = ["rcgen/aws_lc_rs_unstable"]
 fips = ["dep:aws-lc-rs", "rcgen/aws_lc_rs", "aws-lc-rs/fips"]
 ring = ["dep:ring", "rcgen/ring"]
 

rustls-cert-gen/Cargo.toml

@@ -194,6 +194,12 @@ pub enum KeyPairAlgorithm {
 	EcdsaP384,
 	#[cfg(feature = "aws_lc_rs")]
 	EcdsaP521,
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	MlDsa44,
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	MlDsa65,
+	#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+	MlDsa87,
 }
 
 impl From<KeyPairAlgorithm> for &'static SignatureAlgorithm {
@@ -205,6 +211,12 @@ impl From<KeyPairAlgorithm> for &'static SignatureAlgorithm {
 			KeyPairAlgorithm::EcdsaP384 => &rcgen::PKCS_ECDSA_P384_SHA384,
 			#[cfg(feature = "aws_lc_rs")]
 			KeyPairAlgorithm::EcdsaP521 => &rcgen::PKCS_ECDSA_P521_SHA512,
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa44 => &rcgen::PKCS_ML_DSA_44,
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa65 => &rcgen::PKCS_ML_DSA_65,
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa87 => &rcgen::PKCS_ML_DSA_87,
 		}
 	}
 }
@@ -218,6 +230,12 @@ impl fmt::Display for KeyPairAlgorithm {
 			KeyPairAlgorithm::EcdsaP384 => write!(f, "ecdsa-p384"),
 			#[cfg(feature = "aws_lc_rs")]
 			KeyPairAlgorithm::EcdsaP521 => write!(f, "ecdsa-p521"),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa44 => write!(f, "ml-dsa-44"),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa65 => write!(f, "ml-dsa-65"),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			KeyPairAlgorithm::MlDsa87 => write!(f, "ml-dsa-87"),
 		}
 	}
 }
@@ -233,6 +251,12 @@ impl FromStr for KeyPairAlgorithm {
 			"ecdsa-p384" => Ok(Self::EcdsaP384),
 			#[cfg(feature = "aws_lc_rs")]
 			"ecdsa-p521" => Ok(Self::EcdsaP521),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			"ml-dsa-44" => Ok(Self::MlDsa44),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			"ml-dsa-65" => Ok(Self::MlDsa65),
+			#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
+			"ml-dsa-87" => Ok(Self::MlDsa87),
 			_ => Err(anyhow::anyhow!("unknown key algorithm: {s}")),
 		}
 	}

rustls-cert-gen/src/cert.rs

@@ -7,6 +7,7 @@ publish = false
 [features]
 default = []
 aws_lc_rs = ["rcgen/aws_lc_rs"]
+aws_lc_rs_unstable = ["dep:aws-lc-rs", "rcgen/aws_lc_rs_unstable", "rustls-webpki/aws-lc-rs-unstable"]
 fips = ["rcgen/fips"]
 pem = ["dep:pem", "rcgen/pem"]
 ring = ["rcgen/ring"]
@@ -17,13 +18,13 @@ aws-lc-rs = { workspace = true, optional = true }
 pem = { workspace = true, optional = true }
 rcgen = { path = "../rcgen", features = ["pem", "x509-parser"] }
 ring = { workspace = true }
+rustls-webpki = { version = "0.103", features = ["ring", "std"] }
 time = { workspace = true }
 x509-parser = { workspace = true, features = ["verify"], optional = true }
 yasna = { workspace = true }
 
 [dev-dependencies]
 pki-types = { workspace = true }
-rustls-webpki = { version = "0.103", features = ["ring", "std"] }
 botan = { version = "0.11", features = ["vendored"] }
 ring = { workspace = true }