Repository navigation
Detect provider support for ML-DSA external-mu operations - #108
Conversation
Expose a cached per-parameter capability probe that exercises native external-mu signing and verification. SymCrypt supports ML-DSA but rejects external-mu, so callers must distinguish these capabilities before choosing fallback operations. Keep ordinary ML-DSA coverage active and gate only external-mu tests and benchmarks on the new capability. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for the ML-DSA external-mu capability change.
No open issues 🎉
What changed in this PR
Adds a dedicated ML-DSA external-mu capability check so callers can select a fallback when a provider supports ordinary ML-DSA but not external-mu operations.
Changes:
- Adds
SupportsMLDSAExternalMu(params), caching an actual signing and verification probe per parameter set. - Adds capability-consistency tests and gates only external-mu tests and benchmarks, preserving ordinary ML-DSA coverage.
- Requires no new native bindings or generated-code changes.
| File | Description |
|---|---|
openssl/mldsa.go |
Adds the external-mu capability API and cached probes. |
openssl/mldsa_test.go |
Tests capability consistency and gates external-mu tests and benchmarks. |
Review effort: Balanced
|
Microsoft Go integration PRs are ready:
Both pin this fix commit and use the new per-parameter capability to select the existing Go fallback. Built both patched toolchains and confirmed all three |
|
Go 1.27 dependency ordering corrected: the focused backport is #109 targeting |
Benchmark Results✅ ❌
|
Summary
Add
SupportsMLDSAExternalMu(params)so callers can distinguish general ML-DSA support from external-mu signing/verification support.Azure Linux 4’s SymCrypt provider supports ML-DSA-44/65/87 but rejects the external-mu parameter (
p_scossl_mldsa_set_ctx_params: not supported). This currently breakscrypto/mldsa.TestExternalMuin microsoft/go#2651.Validation
CGO_ENABLED=0andCGO_ENABLED=1; external-mu is correctly reported unsupported while ordinary signing/verification remain covered.go vet ./opensslandgit diff --checkpass.Microsoft Go integration PRs will use this capability to choose the existing Go fallback, rather than skipping standard-library tests.