Skip to content

crypto/mldsa: respect OpenSSL external-mu capabilities #2662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
George Adams (gdams) merged 2 commits into from
Oct 28, 2026
Merged

crypto/mldsa: respect OpenSSL external-mu capabilities #2662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8253fc9
crypto/mldsa: respect OpenSSL external-mu capabilities
gdams Oct 28, 2026
f06b6b2
Use merged OpenSSL main fix and tidy backend module
gdams Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cryptobackend/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.26.0

require (
github.com/microsoft/go-crypto-darwin v0.0.3-0.20261026090017-171c4346c8c7
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261026090129-f83222ce3a39
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261028130524-c9be04267896
github.com/microsoft/go-crypto-winnative v0.0.0-20261026140708-37ac3f543832
golang.org/x/crypto v0.57.1-0.20260921070245-7a4a4d6beae2
)
Expand Down
4 changes: 2 additions & 2 deletions cryptobackend/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
github.com/microsoft/go-crypto-darwin v0.0.3-0.20261026090017-171c4346c8c7 h1:KqCuZFj0Vtzr+BYP7g4CiIuyoaOdIs+qRrLQiznTIJ4=
github.com/microsoft/go-crypto-darwin v0.0.3-0.20261026090017-171c4346c8c7/go.mod h1:Qk7P66UNeurLdefRFjOLOra7dGK2KDwI7zV19wUqNSc=
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261026090129-f83222ce3a39 h1:v1QjQa/33Fr93q2QZv6SpiPVz66b1Na+XiihtgV+DJ4=
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261026090129-f83222ce3a39/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M=
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261028130524-c9be04267896 h1:1lSixLTjxTJrebi1GwaQFEJSBp1HkRXTbmUz9MZc1DU=
github.com/microsoft/go-crypto-openssl v0.5.1-0.20261028130524-c9be04267896/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M=
github.com/microsoft/go-crypto-winnative v0.0.0-20261026140708-37ac3f543832 h1:j9iNaPbnm5YcNqOxBbOFzvRhzKdnYRTVsTGUjAcZhxk=
github.com/microsoft/go-crypto-winnative v0.0.0-20261026140708-37ac3f543832/go.mod h1:ic6qQ5ko8bzigvuQbGMknZ4WzS4/KDQ9cypGMdqn38s=
golang.org/x/crypto v0.57.1-0.20260921070245-7a4a4d6beae2 h1:S2kz2UVkb4BhxS9tvxdkfNT6T8NqtaUQE+qv1ObhJ8w=
Expand Down
10 changes: 5 additions & 5 deletions cryptobackend/mldsa/mldsa_darwin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ type Parameters = xcrypto.MLDSAParameters
type backendPrivateKey = xcrypto.PrivateKeyMLDSA
type backendPublicKey = xcrypto.PublicKeyMLDSA

func MLDSA44() Parameters { return Parameters{} }
func MLDSA65() Parameters { return xcrypto.MLDSA65() }
func MLDSA87() Parameters { return xcrypto.MLDSA87() }
func Supports(params Parameters) bool { return xcrypto.SupportsMLDSA(params) }
func supportsExternalMu() bool { return false }
func MLDSA44() Parameters { return Parameters{} }
func MLDSA65() Parameters { return xcrypto.MLDSA65() }
func MLDSA87() Parameters { return xcrypto.MLDSA87() }
func Supports(params Parameters) bool { return xcrypto.SupportsMLDSA(params) }
func supportsExternalMu(params Parameters) bool { return false }
func generateKey(params Parameters) (*backendPrivateKey, error) {
return xcrypto.GenerateKeyMLDSA(params)
}
Expand Down
2 changes: 1 addition & 1 deletion cryptobackend/mldsa/mldsa_msgostd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ func Sign(priv *PrivateKey, message []byte, context string) ([]byte, error) {
}

func SignExternalMu(priv *PrivateKey, mu []byte) ([]byte, error) {
if priv.backend != nil && supportsExternalMu() && rand.IsDefaultReader(cryptorand.Reader) {
if priv.backend != nil && supportsExternalMu(priv.backend.key.Parameters()) && rand.IsDefaultReader(cryptorand.Reader) {
return priv.backend.key.SignExternalMu(mu)
}
key, err := priv.goKey()
Expand Down
4 changes: 3 additions & 1 deletion cryptobackend/mldsa/mldsa_openssl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ func MLDSA44() Parameters { return openssl.MLDSA44() }
func MLDSA65() Parameters { return openssl.MLDSA65() }
func MLDSA87() Parameters { return openssl.MLDSA87() }
func Supports(params Parameters) bool { return openssl.SupportsMLDSA(params) }
func supportsExternalMu() bool { return true }
func supportsExternalMu(params Parameters) bool {
return openssl.SupportsMLDSAExternalMu(params)
}
func generateKey(params Parameters) (*backendPrivateKey, error) {
return openssl.GenerateKeyMLDSA(params)
}
Expand Down
10 changes: 5 additions & 5 deletions cryptobackend/mldsa/mldsa_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ type Parameters = cng.MLDSAParameters
type backendPrivateKey = cng.PrivateKeyMLDSA
type backendPublicKey = cng.PublicKeyMLDSA

func MLDSA44() Parameters { return cng.MLDSA44() }
func MLDSA65() Parameters { return cng.MLDSA65() }
func MLDSA87() Parameters { return cng.MLDSA87() }
func Supports(params Parameters) bool { return cng.SupportsMLDSA() }
func supportsExternalMu() bool { return true }
func MLDSA44() Parameters { return cng.MLDSA44() }
func MLDSA65() Parameters { return cng.MLDSA65() }
func MLDSA87() Parameters { return cng.MLDSA87() }
func Supports(params Parameters) bool { return cng.SupportsMLDSA() }
func supportsExternalMu(params Parameters) bool { return true }
func generateKey(params Parameters) (*backendPrivateKey, error) {
return cng.GenerateKeyMLDSA(params)
}
Expand Down
12 changes: 6 additions & 6 deletions cryptobackend/mldsa/nobackend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,12 @@ type Parameters struct{}
type backendPrivateKey struct{}
type backendPublicKey struct{}

func MLDSA44() Parameters { panic("cryptobackend: not available") }
func MLDSA65() Parameters { panic("cryptobackend: not available") }
func MLDSA87() Parameters { panic("cryptobackend: not available") }
func (params Parameters) String() string { panic("cryptobackend: not available") }
func Supports(params Parameters) bool { panic("cryptobackend: not available") }
func supportsExternalMu() bool { panic("cryptobackend: not available") }
func MLDSA44() Parameters { panic("cryptobackend: not available") }
func MLDSA65() Parameters { panic("cryptobackend: not available") }
func MLDSA87() Parameters { panic("cryptobackend: not available") }
func (params Parameters) String() string { panic("cryptobackend: not available") }
func Supports(params Parameters) bool { panic("cryptobackend: not available") }
func supportsExternalMu(params Parameters) bool { panic("cryptobackend: not available") }
func generateKey(params Parameters) (*backendPrivateKey, error) {
panic("cryptobackend: not available")
}
Expand Down
Loading
Loading