Skip to content

Take advantage of stable ML-DSA in aws-lc-rs #447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
djc wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Take advantage of stable ML-DSA in aws-lc-rs #447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8402470
Take advantage of stable ML-DSA in aws-lc-rs
djc Aug 11, 2026
85fd881
Upgrade to pem 4
djc Aug 11, 2026
3551072
Upgrade to botan 0.13
djc Aug 11, 2026
9df7910
Bump version to 0.14.10
djc Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 33 additions & 15 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,14 @@ keywords = ["mkcert", "ca", "certificate"]
[workspace.dependencies]
anyhow = "1.0.75"
assert_fs = "1.0.13"
aws-lc-rs = { version = "1.13.3", default-features = false }
botan = { version = "0.12", features = ["vendored"] }
aws-lc-rs = { version = "1.18", default-features = false }
botan = { version = "0.13", features = ["vendored"] }
bpaf = { version = "0.9.5", features = ["derive"] }
openssl = "0.10"
pem = "3.0.2"
pem = "4"
pki-types = { package = "rustls-pki-types", version = "1.4.1" }
ring = "0.17"
rustls-webpki = { version = "0.103", features = ["ring", "std"] }
rustls-webpki = { version = "0.103.14", features = ["ring", "std"] }
time = { version = "0.3.6", default-features = false }
x509-parser = "0.18"
yasna = { version = "0.6", features = ["time", "std"] }
Expand Down
4 changes: 2 additions & 2 deletions rcgen/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "rcgen"
version = "0.14.9"
version = "0.14.10"
documentation = "https://docs.rs/rcgen"
description.workspace = true
repository.workspace = true
Expand All @@ -13,7 +13,7 @@ keywords.workspace = true
[features]
default = ["crypto", "pem", "ring"]
aws_lc_rs = ["crypto", "dep:aws-lc-rs", "aws-lc-rs/aws-lc-sys", "x509-parser?/verify-aws"]
aws_lc_rs_unstable = ["aws_lc_rs", "aws-lc-rs/unstable", "x509-parser?/verify-aws"]
aws_lc_rs_unstable = ["aws_lc_rs"] # For backwards compatibility only
fips = ["crypto", "dep:aws-lc-rs", "aws-lc-rs/fips"]
crypto = []
ring = ["crypto", "dep:ring", "x509-parser?/verify"]
Expand Down
16 changes: 8 additions & 8 deletions rcgen/src/key_pair.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#[cfg(feature = "crypto")]
use std::fmt;

#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
use aws_lc_rs::unstable::signature::PqdsaKeyPair;
#[cfg(feature = "aws_lc_rs")]
use aws_lc_rs::signature::PqdsaKeyPair;
#[cfg(feature = "pem")]
use pem::Pem;
#[cfg(feature = "crypto")]
Expand Down Expand Up @@ -40,7 +40,7 @@ pub(crate) enum KeyPairKind {
/// A Ed25519 key pair
Ed(Ed25519KeyPair),
/// A Pqdsa key pair
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
Pq(PqdsaKeyPair),
/// A RSA key pair
Rsa(RsaKeyPair, &'static dyn RsaEncoding),
Expand All @@ -52,7 +52,7 @@ impl fmt::Debug for KeyPairKind {
match self {
Self::Ec(key_pair) => write!(f, "{key_pair:?}"),
Self::Ed(key_pair) => write!(f, "{key_pair:?}"),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
Self::Pq(key_pair) => write!(f, "{key_pair:?}"),
Self::Rsa(key_pair, _) => write!(f, "{key_pair:?}"),
}
Expand Down Expand Up @@ -119,10 +119,10 @@ impl KeyPair {
serialized_der: key_pair_serialized,
})
},
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
SignAlgo::PqDsa(sign_alg) => {
let key_pair = PqdsaKeyPair::generate(sign_alg)._err()?;
let key_pair_serialized = key_pair.to_pkcs8()._err()?.as_ref().to_vec();
let key_pair_serialized = key_pair.to_pkcs8v1()._err()?.as_ref().to_vec();

Ok(KeyPair {
kind: KeyPairKind::Pq(key_pair),
Expand Down Expand Up @@ -458,7 +458,7 @@ impl SigningKey for KeyPair {
signature.as_ref().to_owned()
},
KeyPairKind::Ed(kp) => kp.sign(msg).as_ref().to_owned(),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairKind::Pq(kp) => {
let mut signature = vec![0; kp.algorithm().signature_len()];
kp.sign(msg, &mut signature)._err()?;
Expand All @@ -481,7 +481,7 @@ impl PublicKeyData for KeyPair {
match &self.kind {
KeyPairKind::Ec(kp) => kp.public_key().as_ref(),
KeyPairKind::Ed(kp) => kp.public_key().as_ref(),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairKind::Pq(kp) => kp.public_key().as_ref(),
KeyPairKind::Rsa(kp, _) => kp.public_key().as_ref(),
}
Expand Down
6 changes: 3 additions & 3 deletions rcgen/src/oid.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,11 @@ pub(crate) const EC_SECP_384_R1: &[u64] = &[1, 3, 132, 0, 34];
#[cfg(feature = "aws_lc_rs")]
pub(crate) const EC_SECP_521_R1: &[u64] = &[1, 3, 132, 0, 35];

#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub(crate) const ML_DSA_44: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 17];
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub(crate) const ML_DSA_65: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 18];
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub(crate) const ML_DSA_87: &[u64] = &[2, 16, 840, 1, 101, 3, 4, 3, 19];

/// rsaEncryption in [RFC 4055](https://www.rfc-editor.org/rfc/rfc4055#section-6)
Expand Down
18 changes: 9 additions & 9 deletions rcgen/src/sign_algo.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
use std::fmt;
use std::hash::{Hash, Hasher};

#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
use aws_lc_rs::unstable::signature::{
#[cfg(feature = "aws_lc_rs")]
use aws_lc_rs::signature::{
PqdsaSigningAlgorithm, ML_DSA_44_SIGNING, ML_DSA_65_SIGNING, ML_DSA_87_SIGNING,
};
use yasna::models::ObjectIdentifier;
Expand All @@ -17,7 +17,7 @@ use crate::Error;
pub(crate) enum SignAlgo {
EcDsa(&'static EcdsaSigningAlgorithm),
EdDsa(&'static EdDSAParameters),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
PqDsa(&'static PqdsaSigningAlgorithm),
Rsa(&'static dyn RsaEncoding),
}
Expand Down Expand Up @@ -230,30 +230,30 @@ pub(crate) mod algo {
};

/// ML-DSA-44 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub static PKCS_ML_DSA_44: SignatureAlgorithm = SignatureAlgorithm {
oids_sign_alg: &[ML_DSA_44],
#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
#[cfg(feature = "crypto")]
sign_alg: SignAlgo::PqDsa(&ML_DSA_44_SIGNING),
oid_components: ML_DSA_44,
params: SignatureAlgorithmParams::None,
};

/// ML-DSA-65 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub static PKCS_ML_DSA_65: SignatureAlgorithm = SignatureAlgorithm {
oids_sign_alg: &[ML_DSA_65],
#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
#[cfg(feature = "crypto")]
sign_alg: SignAlgo::PqDsa(&ML_DSA_65_SIGNING),
oid_components: ML_DSA_65,
params: SignatureAlgorithmParams::None,
};

/// ML-DSA-87 signing as per <https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-12.html#name-identifiers>.
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
pub static PKCS_ML_DSA_87: SignatureAlgorithm = SignatureAlgorithm {
oids_sign_alg: &[ML_DSA_87],
#[cfg(all(feature = "crypto", feature = "aws_lc_rs_unstable"))]
#[cfg(feature = "crypto")]
sign_alg: SignAlgo::PqDsa(&ML_DSA_87_SIGNING),
oid_components: ML_DSA_87,
params: SignatureAlgorithmParams::None,
Expand Down
24 changes: 12 additions & 12 deletions rustls-cert-gen/src/cert.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,11 +197,11 @@ pub enum KeyPairAlgorithm {
EcdsaP384,
#[cfg(feature = "aws_lc_rs")]
EcdsaP521,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
MlDsa44,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
MlDsa65,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
MlDsa87,
}

Expand All @@ -214,11 +214,11 @@ impl From<KeyPairAlgorithm> for &'static SignatureAlgorithm {
KeyPairAlgorithm::EcdsaP384 => &rcgen::PKCS_ECDSA_P384_SHA384,
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::EcdsaP521 => &rcgen::PKCS_ECDSA_P521_SHA512,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa44 => &rcgen::PKCS_ML_DSA_44,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa65 => &rcgen::PKCS_ML_DSA_65,
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa87 => &rcgen::PKCS_ML_DSA_87,
}
}
Expand All @@ -233,11 +233,11 @@ impl fmt::Display for KeyPairAlgorithm {
KeyPairAlgorithm::EcdsaP384 => write!(f, "ecdsa-p384"),
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::EcdsaP521 => write!(f, "ecdsa-p521"),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa44 => write!(f, "ml-dsa-44"),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa65 => write!(f, "ml-dsa-65"),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
KeyPairAlgorithm::MlDsa87 => write!(f, "ml-dsa-87"),
}
}
Expand All @@ -254,11 +254,11 @@ impl FromStr for KeyPairAlgorithm {
"ecdsa-p384" => Ok(Self::EcdsaP384),
#[cfg(feature = "aws_lc_rs")]
"ecdsa-p521" => Ok(Self::EcdsaP521),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
"ml-dsa-44" => Ok(Self::MlDsa44),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
"ml-dsa-65" => Ok(Self::MlDsa65),
#[cfg(all(feature = "aws_lc_rs_unstable", not(feature = "fips")))]
#[cfg(feature = "aws_lc_rs")]
"ml-dsa-87" => Ok(Self::MlDsa87),
_ => Err(anyhow::anyhow!("unknown key algorithm: {s}")),
}
Expand Down
3 changes: 1 addition & 2 deletions verify-tests/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@ publish = false

[features]
default = []
aws_lc_rs = ["rcgen/aws_lc_rs"]
aws_lc_rs_unstable = ["dep:aws-lc-rs", "rcgen/aws_lc_rs_unstable", "rustls-webpki/aws-lc-rs-unstable"]
aws_lc_rs = ["rcgen/aws_lc_rs", "rustls-webpki/aws-lc-rs"]
fips = ["rcgen/fips"]
pem = ["dep:pem", "rcgen/pem"]
ring = ["rcgen/ring"]
Expand Down
10 changes: 5 additions & 5 deletions verify-tests/tests/webpki.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
use std::time::Duration as StdDuration;

#[cfg(feature = "aws_lc_rs_unstable")]
use aws_lc_rs::unstable::signature::{
#[cfg(feature = "aws_lc_rs")]
use aws_lc_rs::signature::{
PqdsaKeyPair, PqdsaSigningAlgorithm, ML_DSA_44_SIGNING, ML_DSA_65_SIGNING, ML_DSA_87_SIGNING,
};
use pki_types::{CertificateDer, ServerName, SignatureVerificationAlgorithm, UnixTime};
Expand Down Expand Up @@ -39,7 +39,7 @@ fn sign_msg_ed25519(key_pair: &KeyPair, msg: &[u8]) -> Vec<u8> {
signature.as_ref().to_vec()
}

#[cfg(feature = "aws_lc_rs_unstable")]
#[cfg(feature = "aws_lc_rs")]
fn sign_msg_pq(key_pair: &KeyPair, msg: &[u8], alg: &'static PqdsaSigningAlgorithm) -> Vec<u8> {
let pk_der = key_pair.serialize_der();
let key_pair = PqdsaKeyPair::from_pkcs8(alg, &pk_der).unwrap();
Expand Down Expand Up @@ -235,7 +235,7 @@ fn test_webpki_rsa_given() {
);
}

#[cfg(all(feature = "pem", feature = "aws_lc_rs_unstable"))]
#[cfg(all(feature = "pem", feature = "aws_lc_rs"))]
#[test]
fn test_webpki_ml_dsa() {
let (params, _) = util::default_params();
Expand All @@ -249,7 +249,7 @@ fn test_webpki_ml_dsa() {
}
}

#[cfg(feature = "aws_lc_rs_unstable")]
#[cfg(feature = "aws_lc_rs")]
const ML_DSA_ALGS: &[(
&rcgen::SignatureAlgorithm,
&dyn SignatureVerificationAlgorithm,
Expand Down
Loading