1 /*
2 * Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <string.h>
11 #include <openssl/byteorder.h>
12 #include <openssl/err.h>
13 #include <openssl/proverr.h>
14 #include <openssl/x509.h>
15 #include <openssl/core_names.h>
16 #include "internal/encoder.h"
17 #include "prov/ml_dsa.h"
18 #include "ml_dsa_codecs.h"
19
20 /*-
21 * Tables describing supported ASN.1 input/output formats.
22 */
23
24 /*-
25 * ML-DSA-44:
26 * Public key bytes: 1312 (0x0520)
27 * Private key bytes: 2560 (0x0a00)
28 */
29 static const ML_COMMON_SPKI_FMT ml_dsa_44_spkifmt = {
30 { 0x30, 0x82, 0x05, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
31 0x01, 0x65, 0x03, 0x04, 0x03, 0x11, 0x03, 0x82, 0x05, 0x21, 0x00, }
32 };
33 static const ML_COMMON_PKCS8_FMT ml_dsa_44_p8fmt[NUM_PKCS8_FORMATS] = {
34 { "seed-priv", 0x0a2a, 0, 0x30820a26, 0x0420, 6, 0x20, 0x04820a00, 0x2a, 0x0a00, 0, 0, },
35 { "priv-only", 0x0a04, 0, 0x04820a00, 0, 0, 0, 0, 0x04, 0x0a00, 0, 0, },
36 { "oqskeypair", 0x0f24, 0, 0x04820f20, 0, 0, 0, 0, 0x04, 0x0a00, 0x0a04, 0x0520 },
37 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
38 { "bare-priv", 0x0a00, 4, 0, 0, 0, 0, 0, 0, 0x0a00, 0, 0, },
39 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
40 };
41
42 /*
43 * ML-DSA-65:
44 * Public key bytes: 1952 (0x07a0)
45 * Private key bytes: 4032 (0x0fc0)
46 */
47 static const ML_COMMON_SPKI_FMT ml_dsa_65_spkifmt = {
48 { 0x30, 0x82, 0x07, 0xb2, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
49 0x01, 0x65, 0x03, 0x04, 0x03, 0x12, 0x03, 0x82, 0x07, 0xa1, 0x00, }
50 };
51 static const ML_COMMON_PKCS8_FMT ml_dsa_65_p8fmt[NUM_PKCS8_FORMATS] = {
52 { "seed-priv", 0x0fea, 0, 0x30820fe6, 0x0420, 6, 0x20, 0x04820fc0, 0x2a, 0x0fc0, 0, 0, },
53 { "priv-only", 0x0fc4, 0, 0x04820fc0, 0, 0, 0, 0, 0x04, 0x0fc0, 0, 0, },
54 { "oqskeypair", 0x1764, 0, 0x04821760, 0, 0, 0, 0, 0x04, 0x0fc0, 0x0fc4, 0x07a0 },
55 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
56 { "bare-priv", 0x0fc0, 4, 0, 0, 0, 0, 0, 0, 0x0fc0, 0, 0, },
57 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
58 };
59
60 /*-
61 * ML-DSA-87:
62 * Public key bytes: 2592 (0x0a20)
63 * Private key bytes: 4896 (0x1320)
64 */
65 static const ML_COMMON_SPKI_FMT ml_dsa_87_spkifmt = {
66 { 0x30, 0x82, 0x0a, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
67 0x01, 0x65, 0x03, 0x04, 0x03, 0x13, 0x03, 0x82, 0x0a, 0x21, 0x00, }
68 };
69 static const ML_COMMON_PKCS8_FMT ml_dsa_87_p8fmt[NUM_PKCS8_FORMATS] = {
70 { "seed-priv", 0x134a, 0, 0x30821346, 0x0420, 6, 0x20, 0x04821320, 0x2a, 0x1320, 0, 0, },
71 { "priv-only", 0x1324, 0, 0x04821320, 0, 0, 0, 0, 0x04, 0x1320, 0, 0, },
72 { "oqskeypair", 0x1d44, 0, 0x04821d40, 0, 0, 0, 0, 0x04, 0x1320, 0x1324, 0x0a20 },
73 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
74 { "bare-priv", 0x1320, 4, 0, 0, 0, 0, 0, 0, 0x1320, 0, 0, },
75 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
76 };
77
78 /* Indices of slots in the codec table below */
79 #define ML_DSA_44_CODEC 0
80 #define ML_DSA_65_CODEC 1
81 #define ML_DSA_87_CODEC 2
82
83 /*
84 * Per-variant fixed parameters
85 */
86 static const ML_COMMON_CODEC codecs[3] = {
87 { &ml_dsa_44_spkifmt, ml_dsa_44_p8fmt },
88 { &ml_dsa_65_spkifmt, ml_dsa_65_p8fmt },
89 { &ml_dsa_87_spkifmt, ml_dsa_87_p8fmt }
90 };
91
92 /* Retrieve the parameters of one of the ML-DSA variants */
ml_dsa_get_codec(int evp_type)93 static const ML_COMMON_CODEC *ml_dsa_get_codec(int evp_type)
94 {
95 switch (evp_type) {
96 case EVP_PKEY_ML_DSA_44:
97 return &codecs[ML_DSA_44_CODEC];
98 case EVP_PKEY_ML_DSA_65:
99 return &codecs[ML_DSA_65_CODEC];
100 case EVP_PKEY_ML_DSA_87:
101 return &codecs[ML_DSA_87_CODEC];
102 }
103 return NULL;
104 }
105
106 ML_DSA_KEY *
ossl_ml_dsa_d2i_PUBKEY(const uint8_t * pk,int pk_len,int evp_type,PROV_CTX * provctx,const char * propq)107 ossl_ml_dsa_d2i_PUBKEY(const uint8_t *pk, int pk_len, int evp_type,
108 PROV_CTX *provctx, const char *propq)
109 {
110 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);
111 const ML_COMMON_CODEC *codec;
112 const ML_DSA_PARAMS *params;
113 ML_DSA_KEY *ret;
114
115 if ((params = ossl_ml_dsa_params_get(evp_type)) == NULL
116 || (codec = ml_dsa_get_codec(evp_type)) == NULL)
117 return NULL;
118 if (pk_len != ML_COMMON_SPKI_OVERHEAD + (ossl_ssize_t) params->pk_len
119 || memcmp(pk, codec->spkifmt->asn1_prefix, ML_COMMON_SPKI_OVERHEAD) != 0)
120 return NULL;
121 pk_len -= ML_COMMON_SPKI_OVERHEAD;
122 pk += ML_COMMON_SPKI_OVERHEAD;
123
124 if ((ret = ossl_ml_dsa_key_new(libctx, propq, evp_type)) == NULL)
125 return NULL;
126
127 if (!ossl_ml_dsa_pk_decode(ret, pk, (size_t) pk_len)) {
128 ERR_raise_data(ERR_LIB_PROV, PROV_R_BAD_ENCODING,
129 "errror parsing %s public key from input SPKI",
130 params->alg);
131 ossl_ml_dsa_key_free(ret);
132 return NULL;
133 }
134
135 return ret;
136 }
137
138 ML_DSA_KEY *
ossl_ml_dsa_d2i_PKCS8(const uint8_t * prvenc,int prvlen,int evp_type,PROV_CTX * provctx,const char * propq)139 ossl_ml_dsa_d2i_PKCS8(const uint8_t *prvenc, int prvlen,
140 int evp_type, PROV_CTX *provctx,
141 const char *propq)
142 {
143 const ML_DSA_PARAMS *v;
144 const ML_COMMON_CODEC *codec;
145 ML_COMMON_PKCS8_FMT_PREF *fmt_slots = NULL, *slot;
146 const ML_COMMON_PKCS8_FMT *p8fmt;
147 ML_DSA_KEY *key = NULL, *ret = NULL;
148 PKCS8_PRIV_KEY_INFO *p8inf = NULL;
149 const uint8_t *buf, *pos;
150 const X509_ALGOR *alg = NULL;
151 const char *formats;
152 int len, ptype;
153 uint32_t magic;
154 uint16_t seed_magic;
155 const uint8_t *seed = NULL;
156 const uint8_t *priv = NULL;
157
158 /* Which ML-DSA variant? */
159 if ((v = ossl_ml_dsa_params_get(evp_type)) == NULL
160 || (codec = ml_dsa_get_codec(evp_type)) == NULL)
161 return 0;
162
163 /* Extract the key OID and any parameters. */
164 if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &prvenc, prvlen)) == NULL)
165 return 0;
166 /* Shortest prefix is 4 bytes: seq tag/len + octet string tag/len */
167 if (!PKCS8_pkey_get0(NULL, &buf, &len, &alg, p8inf))
168 goto end;
169 /* Bail out early if this is some other key type. */
170 if (OBJ_obj2nid(alg->algorithm) != evp_type)
171 goto end;
172
173 /* Get the list of enabled decoders. Their order is not important here. */
174 formats = ossl_prov_ctx_get_param(
175 provctx, OSSL_PKEY_PARAM_ML_DSA_INPUT_FORMATS, NULL);
176 fmt_slots = ossl_ml_common_pkcs8_fmt_order(v->alg, codec->p8fmt,
177 "input", formats);
178 if (fmt_slots == NULL)
179 goto end;
180
181 /* Parameters must be absent. */
182 X509_ALGOR_get0(NULL, &ptype, NULL, alg);
183 if (ptype != V_ASN1_UNDEF) {
184 ERR_raise_data(ERR_LIB_PROV, PROV_R_UNEXPECTED_KEY_PARAMETERS,
185 "unexpected parameters with a PKCS#8 %s private key",
186 v->alg);
187 goto end;
188 }
189 if ((ossl_ssize_t)len < (ossl_ssize_t)sizeof(magic))
190 goto end;
191
192 /* Find the matching p8 info slot, that also has the expected length. */
193 pos = OPENSSL_load_u32_be(&magic, buf);
194 for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot) {
195 if (len != (ossl_ssize_t)p8fmt->p8_bytes)
196 continue;
197 if (p8fmt->p8_shift == sizeof(magic)
198 || (magic >> (p8fmt->p8_shift * 8)) == p8fmt->p8_magic) {
199 pos -= p8fmt->p8_shift;
200 break;
201 }
202 }
203 if (p8fmt == NULL
204 || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES)
205 || (p8fmt->priv_length > 0 && p8fmt->priv_length != v->sk_len)
206 || (p8fmt->pub_length > 0 && p8fmt->pub_length != v->pk_len)) {
207 ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT,
208 "no matching enabled %s private key input formats",
209 v->alg);
210 goto end;
211 }
212
213 if (p8fmt->seed_length > 0) {
214 /* Check |seed| tag/len, if not subsumed by |magic|. */
215 if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset) {
216 pos = OPENSSL_load_u16_be(&seed_magic, pos);
217 if (seed_magic != p8fmt->seed_magic)
218 goto end;
219 } else if (pos != buf + p8fmt->seed_offset) {
220 goto end;
221 }
222 pos += ML_DSA_SEED_BYTES;
223 }
224 if (p8fmt->priv_length > 0) {
225 /* Check |priv| tag/len */
226 if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset) {
227 pos = OPENSSL_load_u32_be(&magic, pos);
228 if (magic != p8fmt->priv_magic)
229 goto end;
230 } else if (pos != buf + p8fmt->priv_offset) {
231 goto end;
232 }
233 pos += v->sk_len;
234 }
235 if (p8fmt->pub_length > 0) {
236 if (pos != buf + p8fmt->pub_offset)
237 goto end;
238 pos += v->pk_len;
239 }
240 if (pos != buf + len)
241 goto end;
242
243 /*
244 * Collect the seed and/or key into a "decoded" private key object,
245 * to be turned into a real key on provider "load" or "import".
246 */
247 if ((key = ossl_prov_ml_dsa_new(provctx, propq, evp_type)) == NULL)
248 goto end;
249 if (p8fmt->seed_length > 0)
250 seed = buf + p8fmt->seed_offset;
251 if (p8fmt->priv_length > 0)
252 priv = buf + p8fmt->priv_offset;
253 /* Any OQS public key content is ignored */
254
255 if (ossl_ml_dsa_set_prekey(key, 0, 0,
256 seed, ML_DSA_SEED_BYTES, priv, v->sk_len))
257 ret = key;
258
259 end:
260 OPENSSL_free(fmt_slots);
261 PKCS8_PRIV_KEY_INFO_free(p8inf);
262 if (ret == NULL)
263 ossl_ml_dsa_key_free(key);
264 return ret;
265 }
266
267 /* Same as ossl_ml_dsa_encode_pubkey, but allocates the output buffer. */
ossl_ml_dsa_i2d_pubkey(const ML_DSA_KEY * key,unsigned char ** out)268 int ossl_ml_dsa_i2d_pubkey(const ML_DSA_KEY *key, unsigned char **out)
269 {
270 const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key);
271 const uint8_t *pk = ossl_ml_dsa_key_get_pub(key);
272
273 if (pk == NULL) {
274 ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PUBLIC_KEY,
275 "no %s public key data available", params->alg);
276 return 0;
277 }
278 if (out != NULL
279 && (*out = OPENSSL_memdup(pk, params->pk_len)) == NULL)
280 return 0;
281 return (int)params->pk_len;
282 }
283
284 /* Allocate and encode PKCS#8 private key payload. */
ossl_ml_dsa_i2d_prvkey(const ML_DSA_KEY * key,uint8_t ** out,PROV_CTX * provctx)285 int ossl_ml_dsa_i2d_prvkey(const ML_DSA_KEY *key, uint8_t **out,
286 PROV_CTX *provctx)
287 {
288 const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key);
289 const ML_COMMON_CODEC *codec;
290 ML_COMMON_PKCS8_FMT_PREF *fmt_slots, *slot;
291 const ML_COMMON_PKCS8_FMT *p8fmt;
292 uint8_t *buf = NULL, *pos;
293 const char *formats;
294 int len = ML_DSA_SEED_BYTES;
295 int ret = 0;
296 const uint8_t *seed = ossl_ml_dsa_key_get_seed(key);
297 const uint8_t *sk = ossl_ml_dsa_key_get_priv(key);
298
299 /* Not ours to handle */
300 if ((codec = ml_dsa_get_codec(params->evp_type)) == NULL)
301 return 0;
302
303 if (sk == NULL) {
304 ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PRIVATE_KEY,
305 "no %s private key data available",
306 params->alg);
307 return 0;
308 }
309
310 formats = ossl_prov_ctx_get_param(
311 provctx, OSSL_PKEY_PARAM_ML_DSA_OUTPUT_FORMATS, NULL);
312 fmt_slots = ossl_ml_common_pkcs8_fmt_order(params->alg, codec->p8fmt,
313 "output", formats);
314 if (fmt_slots == NULL)
315 return 0;
316
317 /* If we don't have a seed, skip seedful entries */
318 for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot)
319 if (seed != NULL || p8fmt->seed_length == 0)
320 break;
321 /* No matching table entries, give up */
322 if (p8fmt == NULL
323 || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES)
324 || (p8fmt->priv_length > 0 && p8fmt->priv_length != params->sk_len)
325 || (p8fmt->pub_length > 0 && p8fmt->pub_length != params->pk_len)) {
326 ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT,
327 "no matching enabled %s private key output formats",
328 params->alg);
329 goto end;
330 }
331 len = p8fmt->p8_bytes;
332
333 if (out == NULL) {
334 ret = len;
335 goto end;
336 }
337
338 if ((pos = buf = OPENSSL_malloc((size_t) len)) == NULL)
339 goto end;
340
341 switch (p8fmt->p8_shift) {
342 case 0:
343 pos = OPENSSL_store_u32_be(pos, p8fmt->p8_magic);
344 break;
345 case 2:
346 pos = OPENSSL_store_u16_be(pos, (uint16_t)p8fmt->p8_magic);
347 break;
348 case 4:
349 break;
350 default:
351 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
352 "error encoding %s private key", params->alg);
353 goto end;
354 }
355
356 if (p8fmt->seed_length != 0) {
357 /*
358 * Either the tag/len were already included in |magic| or they require
359 * us to write two bytes now.
360 */
361 if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset)
362 pos = OPENSSL_store_u16_be(pos, p8fmt->seed_magic);
363 if (pos != buf + p8fmt->seed_offset) {
364 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
365 "error encoding %s private key", params->alg);
366 goto end;
367 }
368 memcpy(pos, seed, ML_DSA_SEED_BYTES);
369 pos += ML_DSA_SEED_BYTES;
370 }
371 if (p8fmt->priv_length != 0) {
372 if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset)
373 pos = OPENSSL_store_u32_be(pos, p8fmt->priv_magic);
374 if (pos != buf + p8fmt->priv_offset) {
375 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
376 "error encoding %s private key", params->alg);
377 goto end;
378 }
379 memcpy(pos, sk, params->sk_len);
380 pos += params->sk_len;
381 }
382 /* OQS form output with tacked-on public key */
383 if (p8fmt->pub_length != 0) {
384 /* The OQS pubkey is never separately DER-wrapped */
385 if (pos != buf + p8fmt->pub_offset) {
386 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
387 "error encoding %s private key", params->alg);
388 goto end;
389 }
390 memcpy(pos, ossl_ml_dsa_key_get_pub(key), params->pk_len);
391 pos += params->pk_len;
392 }
393
394 if (pos == buf + len) {
395 *out = buf;
396 ret = len;
397 }
398
399 end:
400 OPENSSL_free(fmt_slots);
401 if (ret == 0)
402 OPENSSL_free(buf);
403 return ret;
404 }
405
ossl_ml_dsa_key_to_text(BIO * out,const ML_DSA_KEY * key,int selection)406 int ossl_ml_dsa_key_to_text(BIO *out, const ML_DSA_KEY *key, int selection)
407 {
408 const ML_DSA_PARAMS *params;
409 const uint8_t *seed, *sk, *pk;
410
411 if (out == NULL || key == NULL) {
412 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER);
413 return 0;
414 }
415 params = ossl_ml_dsa_key_params(key);
416 pk = ossl_ml_dsa_key_get_pub(key);
417 sk = ossl_ml_dsa_key_get_priv(key);
418 seed = ossl_ml_dsa_key_get_seed(key);
419
420 if (pk == NULL) {
421 /* Regardless of the |selection|, there must be a public key */
422 ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY,
423 "no %s key material available", params->alg);
424 return 0;
425 }
426
427 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
428 if (sk == NULL) {
429 ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY,
430 "no %s key material available", params->alg);
431 return 0;
432 }
433 if (BIO_printf(out, "%s Private-Key:\n", params->alg) <= 0)
434 return 0;
435 if (seed != NULL && !ossl_bio_print_labeled_buf(out, "seed:", seed,
436 ML_DSA_SEED_BYTES))
437 return 0;
438 if (!ossl_bio_print_labeled_buf(out, "priv:", sk, params->sk_len))
439 return 0;
440 } else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
441 if (BIO_printf(out, "%s Public-Key:\n", params->alg) <= 0)
442 return 0;
443 }
444
445 if (!ossl_bio_print_labeled_buf(out, "pub:", pk, params->pk_len))
446 return 0;
447
448 return 1;
449 }
450