1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery #include <string.h>
11*e7be843bSPierre Pronchery #include <openssl/byteorder.h>
12*e7be843bSPierre Pronchery #include <openssl/err.h>
13*e7be843bSPierre Pronchery #include <openssl/proverr.h>
14*e7be843bSPierre Pronchery #include <openssl/x509.h>
15*e7be843bSPierre Pronchery #include <openssl/core_names.h>
16*e7be843bSPierre Pronchery #include "internal/encoder.h"
17*e7be843bSPierre Pronchery #include "prov/ml_dsa.h"
18*e7be843bSPierre Pronchery #include "ml_dsa_codecs.h"
19*e7be843bSPierre Pronchery
20*e7be843bSPierre Pronchery /*-
21*e7be843bSPierre Pronchery * Tables describing supported ASN.1 input/output formats.
22*e7be843bSPierre Pronchery */
23*e7be843bSPierre Pronchery
24*e7be843bSPierre Pronchery /*-
25*e7be843bSPierre Pronchery * ML-DSA-44:
26*e7be843bSPierre Pronchery * Public key bytes: 1312 (0x0520)
27*e7be843bSPierre Pronchery * Private key bytes: 2560 (0x0a00)
28*e7be843bSPierre Pronchery */
29*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_dsa_44_spkifmt = {
30*e7be843bSPierre Pronchery { 0x30, 0x82, 0x05, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
31*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x03, 0x11, 0x03, 0x82, 0x05, 0x21, 0x00, }
32*e7be843bSPierre Pronchery };
33*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_dsa_44_p8fmt[NUM_PKCS8_FORMATS] = {
34*e7be843bSPierre Pronchery { "seed-priv", 0x0a2a, 0, 0x30820a26, 0x0420, 6, 0x20, 0x04820a00, 0x2a, 0x0a00, 0, 0, },
35*e7be843bSPierre Pronchery { "priv-only", 0x0a04, 0, 0x04820a00, 0, 0, 0, 0, 0x04, 0x0a00, 0, 0, },
36*e7be843bSPierre Pronchery { "oqskeypair", 0x0f24, 0, 0x04820f20, 0, 0, 0, 0, 0x04, 0x0a00, 0x0a04, 0x0520 },
37*e7be843bSPierre Pronchery { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
38*e7be843bSPierre Pronchery { "bare-priv", 0x0a00, 4, 0, 0, 0, 0, 0, 0, 0x0a00, 0, 0, },
39*e7be843bSPierre Pronchery { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
40*e7be843bSPierre Pronchery };
41*e7be843bSPierre Pronchery
42*e7be843bSPierre Pronchery /*
43*e7be843bSPierre Pronchery * ML-DSA-65:
44*e7be843bSPierre Pronchery * Public key bytes: 1952 (0x07a0)
45*e7be843bSPierre Pronchery * Private key bytes: 4032 (0x0fc0)
46*e7be843bSPierre Pronchery */
47*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_dsa_65_spkifmt = {
48*e7be843bSPierre Pronchery { 0x30, 0x82, 0x07, 0xb2, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
49*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x03, 0x12, 0x03, 0x82, 0x07, 0xa1, 0x00, }
50*e7be843bSPierre Pronchery };
51*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_dsa_65_p8fmt[NUM_PKCS8_FORMATS] = {
52*e7be843bSPierre Pronchery { "seed-priv", 0x0fea, 0, 0x30820fe6, 0x0420, 6, 0x20, 0x04820fc0, 0x2a, 0x0fc0, 0, 0, },
53*e7be843bSPierre Pronchery { "priv-only", 0x0fc4, 0, 0x04820fc0, 0, 0, 0, 0, 0x04, 0x0fc0, 0, 0, },
54*e7be843bSPierre Pronchery { "oqskeypair", 0x1764, 0, 0x04821760, 0, 0, 0, 0, 0x04, 0x0fc0, 0x0fc4, 0x07a0 },
55*e7be843bSPierre Pronchery { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
56*e7be843bSPierre Pronchery { "bare-priv", 0x0fc0, 4, 0, 0, 0, 0, 0, 0, 0x0fc0, 0, 0, },
57*e7be843bSPierre Pronchery { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
58*e7be843bSPierre Pronchery };
59*e7be843bSPierre Pronchery
60*e7be843bSPierre Pronchery /*-
61*e7be843bSPierre Pronchery * ML-DSA-87:
62*e7be843bSPierre Pronchery * Public key bytes: 2592 (0x0a20)
63*e7be843bSPierre Pronchery * Private key bytes: 4896 (0x1320)
64*e7be843bSPierre Pronchery */
65*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_dsa_87_spkifmt = {
66*e7be843bSPierre Pronchery { 0x30, 0x82, 0x0a, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
67*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x03, 0x13, 0x03, 0x82, 0x0a, 0x21, 0x00, }
68*e7be843bSPierre Pronchery };
69*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_dsa_87_p8fmt[NUM_PKCS8_FORMATS] = {
70*e7be843bSPierre Pronchery { "seed-priv", 0x134a, 0, 0x30821346, 0x0420, 6, 0x20, 0x04821320, 0x2a, 0x1320, 0, 0, },
71*e7be843bSPierre Pronchery { "priv-only", 0x1324, 0, 0x04821320, 0, 0, 0, 0, 0x04, 0x1320, 0, 0, },
72*e7be843bSPierre Pronchery { "oqskeypair", 0x1d44, 0, 0x04821d40, 0, 0, 0, 0, 0x04, 0x1320, 0x1324, 0x0a20 },
73*e7be843bSPierre Pronchery { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, },
74*e7be843bSPierre Pronchery { "bare-priv", 0x1320, 4, 0, 0, 0, 0, 0, 0, 0x1320, 0, 0, },
75*e7be843bSPierre Pronchery { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, },
76*e7be843bSPierre Pronchery };
77*e7be843bSPierre Pronchery
78*e7be843bSPierre Pronchery /* Indices of slots in the codec table below */
79*e7be843bSPierre Pronchery #define ML_DSA_44_CODEC 0
80*e7be843bSPierre Pronchery #define ML_DSA_65_CODEC 1
81*e7be843bSPierre Pronchery #define ML_DSA_87_CODEC 2
82*e7be843bSPierre Pronchery
83*e7be843bSPierre Pronchery /*
84*e7be843bSPierre Pronchery * Per-variant fixed parameters
85*e7be843bSPierre Pronchery */
86*e7be843bSPierre Pronchery static const ML_COMMON_CODEC codecs[3] = {
87*e7be843bSPierre Pronchery { &ml_dsa_44_spkifmt, ml_dsa_44_p8fmt },
88*e7be843bSPierre Pronchery { &ml_dsa_65_spkifmt, ml_dsa_65_p8fmt },
89*e7be843bSPierre Pronchery { &ml_dsa_87_spkifmt, ml_dsa_87_p8fmt }
90*e7be843bSPierre Pronchery };
91*e7be843bSPierre Pronchery
92*e7be843bSPierre Pronchery /* Retrieve the parameters of one of the ML-DSA variants */
ml_dsa_get_codec(int evp_type)93*e7be843bSPierre Pronchery static const ML_COMMON_CODEC *ml_dsa_get_codec(int evp_type)
94*e7be843bSPierre Pronchery {
95*e7be843bSPierre Pronchery switch (evp_type) {
96*e7be843bSPierre Pronchery case EVP_PKEY_ML_DSA_44:
97*e7be843bSPierre Pronchery return &codecs[ML_DSA_44_CODEC];
98*e7be843bSPierre Pronchery case EVP_PKEY_ML_DSA_65:
99*e7be843bSPierre Pronchery return &codecs[ML_DSA_65_CODEC];
100*e7be843bSPierre Pronchery case EVP_PKEY_ML_DSA_87:
101*e7be843bSPierre Pronchery return &codecs[ML_DSA_87_CODEC];
102*e7be843bSPierre Pronchery }
103*e7be843bSPierre Pronchery return NULL;
104*e7be843bSPierre Pronchery }
105*e7be843bSPierre Pronchery
106*e7be843bSPierre Pronchery ML_DSA_KEY *
ossl_ml_dsa_d2i_PUBKEY(const uint8_t * pk,int pk_len,int evp_type,PROV_CTX * provctx,const char * propq)107*e7be843bSPierre Pronchery ossl_ml_dsa_d2i_PUBKEY(const uint8_t *pk, int pk_len, int evp_type,
108*e7be843bSPierre Pronchery PROV_CTX *provctx, const char *propq)
109*e7be843bSPierre Pronchery {
110*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);
111*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
112*e7be843bSPierre Pronchery const ML_DSA_PARAMS *params;
113*e7be843bSPierre Pronchery ML_DSA_KEY *ret;
114*e7be843bSPierre Pronchery
115*e7be843bSPierre Pronchery if ((params = ossl_ml_dsa_params_get(evp_type)) == NULL
116*e7be843bSPierre Pronchery || (codec = ml_dsa_get_codec(evp_type)) == NULL)
117*e7be843bSPierre Pronchery return NULL;
118*e7be843bSPierre Pronchery if (pk_len != ML_COMMON_SPKI_OVERHEAD + (ossl_ssize_t) params->pk_len
119*e7be843bSPierre Pronchery || memcmp(pk, codec->spkifmt->asn1_prefix, ML_COMMON_SPKI_OVERHEAD) != 0)
120*e7be843bSPierre Pronchery return NULL;
121*e7be843bSPierre Pronchery pk_len -= ML_COMMON_SPKI_OVERHEAD;
122*e7be843bSPierre Pronchery pk += ML_COMMON_SPKI_OVERHEAD;
123*e7be843bSPierre Pronchery
124*e7be843bSPierre Pronchery if ((ret = ossl_ml_dsa_key_new(libctx, propq, evp_type)) == NULL)
125*e7be843bSPierre Pronchery return NULL;
126*e7be843bSPierre Pronchery
127*e7be843bSPierre Pronchery if (!ossl_ml_dsa_pk_decode(ret, pk, (size_t) pk_len)) {
128*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_BAD_ENCODING,
129*e7be843bSPierre Pronchery "errror parsing %s public key from input SPKI",
130*e7be843bSPierre Pronchery params->alg);
131*e7be843bSPierre Pronchery ossl_ml_dsa_key_free(ret);
132*e7be843bSPierre Pronchery return NULL;
133*e7be843bSPierre Pronchery }
134*e7be843bSPierre Pronchery
135*e7be843bSPierre Pronchery return ret;
136*e7be843bSPierre Pronchery }
137*e7be843bSPierre Pronchery
138*e7be843bSPierre Pronchery ML_DSA_KEY *
ossl_ml_dsa_d2i_PKCS8(const uint8_t * prvenc,int prvlen,int evp_type,PROV_CTX * provctx,const char * propq)139*e7be843bSPierre Pronchery ossl_ml_dsa_d2i_PKCS8(const uint8_t *prvenc, int prvlen,
140*e7be843bSPierre Pronchery int evp_type, PROV_CTX *provctx,
141*e7be843bSPierre Pronchery const char *propq)
142*e7be843bSPierre Pronchery {
143*e7be843bSPierre Pronchery const ML_DSA_PARAMS *v;
144*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
145*e7be843bSPierre Pronchery ML_COMMON_PKCS8_FMT_PREF *fmt_slots = NULL, *slot;
146*e7be843bSPierre Pronchery const ML_COMMON_PKCS8_FMT *p8fmt;
147*e7be843bSPierre Pronchery ML_DSA_KEY *key = NULL, *ret = NULL;
148*e7be843bSPierre Pronchery PKCS8_PRIV_KEY_INFO *p8inf = NULL;
149*e7be843bSPierre Pronchery const uint8_t *buf, *pos;
150*e7be843bSPierre Pronchery const X509_ALGOR *alg = NULL;
151*e7be843bSPierre Pronchery const char *formats;
152*e7be843bSPierre Pronchery int len, ptype;
153*e7be843bSPierre Pronchery uint32_t magic;
154*e7be843bSPierre Pronchery uint16_t seed_magic;
155*e7be843bSPierre Pronchery const uint8_t *seed = NULL;
156*e7be843bSPierre Pronchery const uint8_t *priv = NULL;
157*e7be843bSPierre Pronchery
158*e7be843bSPierre Pronchery /* Which ML-DSA variant? */
159*e7be843bSPierre Pronchery if ((v = ossl_ml_dsa_params_get(evp_type)) == NULL
160*e7be843bSPierre Pronchery || (codec = ml_dsa_get_codec(evp_type)) == NULL)
161*e7be843bSPierre Pronchery return 0;
162*e7be843bSPierre Pronchery
163*e7be843bSPierre Pronchery /* Extract the key OID and any parameters. */
164*e7be843bSPierre Pronchery if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &prvenc, prvlen)) == NULL)
165*e7be843bSPierre Pronchery return 0;
166*e7be843bSPierre Pronchery /* Shortest prefix is 4 bytes: seq tag/len + octet string tag/len */
167*e7be843bSPierre Pronchery if (!PKCS8_pkey_get0(NULL, &buf, &len, &alg, p8inf))
168*e7be843bSPierre Pronchery goto end;
169*e7be843bSPierre Pronchery /* Bail out early if this is some other key type. */
170*e7be843bSPierre Pronchery if (OBJ_obj2nid(alg->algorithm) != evp_type)
171*e7be843bSPierre Pronchery goto end;
172*e7be843bSPierre Pronchery
173*e7be843bSPierre Pronchery /* Get the list of enabled decoders. Their order is not important here. */
174*e7be843bSPierre Pronchery formats = ossl_prov_ctx_get_param(
175*e7be843bSPierre Pronchery provctx, OSSL_PKEY_PARAM_ML_DSA_INPUT_FORMATS, NULL);
176*e7be843bSPierre Pronchery fmt_slots = ossl_ml_common_pkcs8_fmt_order(v->alg, codec->p8fmt,
177*e7be843bSPierre Pronchery "input", formats);
178*e7be843bSPierre Pronchery if (fmt_slots == NULL)
179*e7be843bSPierre Pronchery goto end;
180*e7be843bSPierre Pronchery
181*e7be843bSPierre Pronchery /* Parameters must be absent. */
182*e7be843bSPierre Pronchery X509_ALGOR_get0(NULL, &ptype, NULL, alg);
183*e7be843bSPierre Pronchery if (ptype != V_ASN1_UNDEF) {
184*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_UNEXPECTED_KEY_PARAMETERS,
185*e7be843bSPierre Pronchery "unexpected parameters with a PKCS#8 %s private key",
186*e7be843bSPierre Pronchery v->alg);
187*e7be843bSPierre Pronchery goto end;
188*e7be843bSPierre Pronchery }
189*e7be843bSPierre Pronchery if ((ossl_ssize_t)len < (ossl_ssize_t)sizeof(magic))
190*e7be843bSPierre Pronchery goto end;
191*e7be843bSPierre Pronchery
192*e7be843bSPierre Pronchery /* Find the matching p8 info slot, that also has the expected length. */
193*e7be843bSPierre Pronchery pos = OPENSSL_load_u32_be(&magic, buf);
194*e7be843bSPierre Pronchery for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot) {
195*e7be843bSPierre Pronchery if (len != (ossl_ssize_t)p8fmt->p8_bytes)
196*e7be843bSPierre Pronchery continue;
197*e7be843bSPierre Pronchery if (p8fmt->p8_shift == sizeof(magic)
198*e7be843bSPierre Pronchery || (magic >> (p8fmt->p8_shift * 8)) == p8fmt->p8_magic) {
199*e7be843bSPierre Pronchery pos -= p8fmt->p8_shift;
200*e7be843bSPierre Pronchery break;
201*e7be843bSPierre Pronchery }
202*e7be843bSPierre Pronchery }
203*e7be843bSPierre Pronchery if (p8fmt == NULL
204*e7be843bSPierre Pronchery || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES)
205*e7be843bSPierre Pronchery || (p8fmt->priv_length > 0 && p8fmt->priv_length != v->sk_len)
206*e7be843bSPierre Pronchery || (p8fmt->pub_length > 0 && p8fmt->pub_length != v->pk_len)) {
207*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT,
208*e7be843bSPierre Pronchery "no matching enabled %s private key input formats",
209*e7be843bSPierre Pronchery v->alg);
210*e7be843bSPierre Pronchery goto end;
211*e7be843bSPierre Pronchery }
212*e7be843bSPierre Pronchery
213*e7be843bSPierre Pronchery if (p8fmt->seed_length > 0) {
214*e7be843bSPierre Pronchery /* Check |seed| tag/len, if not subsumed by |magic|. */
215*e7be843bSPierre Pronchery if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset) {
216*e7be843bSPierre Pronchery pos = OPENSSL_load_u16_be(&seed_magic, pos);
217*e7be843bSPierre Pronchery if (seed_magic != p8fmt->seed_magic)
218*e7be843bSPierre Pronchery goto end;
219*e7be843bSPierre Pronchery } else if (pos != buf + p8fmt->seed_offset) {
220*e7be843bSPierre Pronchery goto end;
221*e7be843bSPierre Pronchery }
222*e7be843bSPierre Pronchery pos += ML_DSA_SEED_BYTES;
223*e7be843bSPierre Pronchery }
224*e7be843bSPierre Pronchery if (p8fmt->priv_length > 0) {
225*e7be843bSPierre Pronchery /* Check |priv| tag/len */
226*e7be843bSPierre Pronchery if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset) {
227*e7be843bSPierre Pronchery pos = OPENSSL_load_u32_be(&magic, pos);
228*e7be843bSPierre Pronchery if (magic != p8fmt->priv_magic)
229*e7be843bSPierre Pronchery goto end;
230*e7be843bSPierre Pronchery } else if (pos != buf + p8fmt->priv_offset) {
231*e7be843bSPierre Pronchery goto end;
232*e7be843bSPierre Pronchery }
233*e7be843bSPierre Pronchery pos += v->sk_len;
234*e7be843bSPierre Pronchery }
235*e7be843bSPierre Pronchery if (p8fmt->pub_length > 0) {
236*e7be843bSPierre Pronchery if (pos != buf + p8fmt->pub_offset)
237*e7be843bSPierre Pronchery goto end;
238*e7be843bSPierre Pronchery pos += v->pk_len;
239*e7be843bSPierre Pronchery }
240*e7be843bSPierre Pronchery if (pos != buf + len)
241*e7be843bSPierre Pronchery goto end;
242*e7be843bSPierre Pronchery
243*e7be843bSPierre Pronchery /*
244*e7be843bSPierre Pronchery * Collect the seed and/or key into a "decoded" private key object,
245*e7be843bSPierre Pronchery * to be turned into a real key on provider "load" or "import".
246*e7be843bSPierre Pronchery */
247*e7be843bSPierre Pronchery if ((key = ossl_prov_ml_dsa_new(provctx, propq, evp_type)) == NULL)
248*e7be843bSPierre Pronchery goto end;
249*e7be843bSPierre Pronchery if (p8fmt->seed_length > 0)
250*e7be843bSPierre Pronchery seed = buf + p8fmt->seed_offset;
251*e7be843bSPierre Pronchery if (p8fmt->priv_length > 0)
252*e7be843bSPierre Pronchery priv = buf + p8fmt->priv_offset;
253*e7be843bSPierre Pronchery /* Any OQS public key content is ignored */
254*e7be843bSPierre Pronchery
255*e7be843bSPierre Pronchery if (ossl_ml_dsa_set_prekey(key, 0, 0,
256*e7be843bSPierre Pronchery seed, ML_DSA_SEED_BYTES, priv, v->sk_len))
257*e7be843bSPierre Pronchery ret = key;
258*e7be843bSPierre Pronchery
259*e7be843bSPierre Pronchery end:
260*e7be843bSPierre Pronchery OPENSSL_free(fmt_slots);
261*e7be843bSPierre Pronchery PKCS8_PRIV_KEY_INFO_free(p8inf);
262*e7be843bSPierre Pronchery if (ret == NULL)
263*e7be843bSPierre Pronchery ossl_ml_dsa_key_free(key);
264*e7be843bSPierre Pronchery return ret;
265*e7be843bSPierre Pronchery }
266*e7be843bSPierre Pronchery
267*e7be843bSPierre Pronchery /* Same as ossl_ml_dsa_encode_pubkey, but allocates the output buffer. */
ossl_ml_dsa_i2d_pubkey(const ML_DSA_KEY * key,unsigned char ** out)268*e7be843bSPierre Pronchery int ossl_ml_dsa_i2d_pubkey(const ML_DSA_KEY *key, unsigned char **out)
269*e7be843bSPierre Pronchery {
270*e7be843bSPierre Pronchery const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key);
271*e7be843bSPierre Pronchery const uint8_t *pk = ossl_ml_dsa_key_get_pub(key);
272*e7be843bSPierre Pronchery
273*e7be843bSPierre Pronchery if (pk == NULL) {
274*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PUBLIC_KEY,
275*e7be843bSPierre Pronchery "no %s public key data available", params->alg);
276*e7be843bSPierre Pronchery return 0;
277*e7be843bSPierre Pronchery }
278*e7be843bSPierre Pronchery if (out != NULL
279*e7be843bSPierre Pronchery && (*out = OPENSSL_memdup(pk, params->pk_len)) == NULL)
280*e7be843bSPierre Pronchery return 0;
281*e7be843bSPierre Pronchery return (int)params->pk_len;
282*e7be843bSPierre Pronchery }
283*e7be843bSPierre Pronchery
284*e7be843bSPierre Pronchery /* Allocate and encode PKCS#8 private key payload. */
ossl_ml_dsa_i2d_prvkey(const ML_DSA_KEY * key,uint8_t ** out,PROV_CTX * provctx)285*e7be843bSPierre Pronchery int ossl_ml_dsa_i2d_prvkey(const ML_DSA_KEY *key, uint8_t **out,
286*e7be843bSPierre Pronchery PROV_CTX *provctx)
287*e7be843bSPierre Pronchery {
288*e7be843bSPierre Pronchery const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key);
289*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
290*e7be843bSPierre Pronchery ML_COMMON_PKCS8_FMT_PREF *fmt_slots, *slot;
291*e7be843bSPierre Pronchery const ML_COMMON_PKCS8_FMT *p8fmt;
292*e7be843bSPierre Pronchery uint8_t *buf = NULL, *pos;
293*e7be843bSPierre Pronchery const char *formats;
294*e7be843bSPierre Pronchery int len = ML_DSA_SEED_BYTES;
295*e7be843bSPierre Pronchery int ret = 0;
296*e7be843bSPierre Pronchery const uint8_t *seed = ossl_ml_dsa_key_get_seed(key);
297*e7be843bSPierre Pronchery const uint8_t *sk = ossl_ml_dsa_key_get_priv(key);
298*e7be843bSPierre Pronchery
299*e7be843bSPierre Pronchery /* Not ours to handle */
300*e7be843bSPierre Pronchery if ((codec = ml_dsa_get_codec(params->evp_type)) == NULL)
301*e7be843bSPierre Pronchery return 0;
302*e7be843bSPierre Pronchery
303*e7be843bSPierre Pronchery if (sk == NULL) {
304*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PRIVATE_KEY,
305*e7be843bSPierre Pronchery "no %s private key data available",
306*e7be843bSPierre Pronchery params->alg);
307*e7be843bSPierre Pronchery return 0;
308*e7be843bSPierre Pronchery }
309*e7be843bSPierre Pronchery
310*e7be843bSPierre Pronchery formats = ossl_prov_ctx_get_param(
311*e7be843bSPierre Pronchery provctx, OSSL_PKEY_PARAM_ML_DSA_OUTPUT_FORMATS, NULL);
312*e7be843bSPierre Pronchery fmt_slots = ossl_ml_common_pkcs8_fmt_order(params->alg, codec->p8fmt,
313*e7be843bSPierre Pronchery "output", formats);
314*e7be843bSPierre Pronchery if (fmt_slots == NULL)
315*e7be843bSPierre Pronchery return 0;
316*e7be843bSPierre Pronchery
317*e7be843bSPierre Pronchery /* If we don't have a seed, skip seedful entries */
318*e7be843bSPierre Pronchery for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot)
319*e7be843bSPierre Pronchery if (seed != NULL || p8fmt->seed_length == 0)
320*e7be843bSPierre Pronchery break;
321*e7be843bSPierre Pronchery /* No matching table entries, give up */
322*e7be843bSPierre Pronchery if (p8fmt == NULL
323*e7be843bSPierre Pronchery || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES)
324*e7be843bSPierre Pronchery || (p8fmt->priv_length > 0 && p8fmt->priv_length != params->sk_len)
325*e7be843bSPierre Pronchery || (p8fmt->pub_length > 0 && p8fmt->pub_length != params->pk_len)) {
326*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT,
327*e7be843bSPierre Pronchery "no matching enabled %s private key output formats",
328*e7be843bSPierre Pronchery params->alg);
329*e7be843bSPierre Pronchery goto end;
330*e7be843bSPierre Pronchery }
331*e7be843bSPierre Pronchery len = p8fmt->p8_bytes;
332*e7be843bSPierre Pronchery
333*e7be843bSPierre Pronchery if (out == NULL) {
334*e7be843bSPierre Pronchery ret = len;
335*e7be843bSPierre Pronchery goto end;
336*e7be843bSPierre Pronchery }
337*e7be843bSPierre Pronchery
338*e7be843bSPierre Pronchery if ((pos = buf = OPENSSL_malloc((size_t) len)) == NULL)
339*e7be843bSPierre Pronchery goto end;
340*e7be843bSPierre Pronchery
341*e7be843bSPierre Pronchery switch (p8fmt->p8_shift) {
342*e7be843bSPierre Pronchery case 0:
343*e7be843bSPierre Pronchery pos = OPENSSL_store_u32_be(pos, p8fmt->p8_magic);
344*e7be843bSPierre Pronchery break;
345*e7be843bSPierre Pronchery case 2:
346*e7be843bSPierre Pronchery pos = OPENSSL_store_u16_be(pos, (uint16_t)p8fmt->p8_magic);
347*e7be843bSPierre Pronchery break;
348*e7be843bSPierre Pronchery case 4:
349*e7be843bSPierre Pronchery break;
350*e7be843bSPierre Pronchery default:
351*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
352*e7be843bSPierre Pronchery "error encoding %s private key", params->alg);
353*e7be843bSPierre Pronchery goto end;
354*e7be843bSPierre Pronchery }
355*e7be843bSPierre Pronchery
356*e7be843bSPierre Pronchery if (p8fmt->seed_length != 0) {
357*e7be843bSPierre Pronchery /*
358*e7be843bSPierre Pronchery * Either the tag/len were already included in |magic| or they require
359*e7be843bSPierre Pronchery * us to write two bytes now.
360*e7be843bSPierre Pronchery */
361*e7be843bSPierre Pronchery if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset)
362*e7be843bSPierre Pronchery pos = OPENSSL_store_u16_be(pos, p8fmt->seed_magic);
363*e7be843bSPierre Pronchery if (pos != buf + p8fmt->seed_offset) {
364*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
365*e7be843bSPierre Pronchery "error encoding %s private key", params->alg);
366*e7be843bSPierre Pronchery goto end;
367*e7be843bSPierre Pronchery }
368*e7be843bSPierre Pronchery memcpy(pos, seed, ML_DSA_SEED_BYTES);
369*e7be843bSPierre Pronchery pos += ML_DSA_SEED_BYTES;
370*e7be843bSPierre Pronchery }
371*e7be843bSPierre Pronchery if (p8fmt->priv_length != 0) {
372*e7be843bSPierre Pronchery if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset)
373*e7be843bSPierre Pronchery pos = OPENSSL_store_u32_be(pos, p8fmt->priv_magic);
374*e7be843bSPierre Pronchery if (pos != buf + p8fmt->priv_offset) {
375*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
376*e7be843bSPierre Pronchery "error encoding %s private key", params->alg);
377*e7be843bSPierre Pronchery goto end;
378*e7be843bSPierre Pronchery }
379*e7be843bSPierre Pronchery memcpy(pos, sk, params->sk_len);
380*e7be843bSPierre Pronchery pos += params->sk_len;
381*e7be843bSPierre Pronchery }
382*e7be843bSPierre Pronchery /* OQS form output with tacked-on public key */
383*e7be843bSPierre Pronchery if (p8fmt->pub_length != 0) {
384*e7be843bSPierre Pronchery /* The OQS pubkey is never separately DER-wrapped */
385*e7be843bSPierre Pronchery if (pos != buf + p8fmt->pub_offset) {
386*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
387*e7be843bSPierre Pronchery "error encoding %s private key", params->alg);
388*e7be843bSPierre Pronchery goto end;
389*e7be843bSPierre Pronchery }
390*e7be843bSPierre Pronchery memcpy(pos, ossl_ml_dsa_key_get_pub(key), params->pk_len);
391*e7be843bSPierre Pronchery pos += params->pk_len;
392*e7be843bSPierre Pronchery }
393*e7be843bSPierre Pronchery
394*e7be843bSPierre Pronchery if (pos == buf + len) {
395*e7be843bSPierre Pronchery *out = buf;
396*e7be843bSPierre Pronchery ret = len;
397*e7be843bSPierre Pronchery }
398*e7be843bSPierre Pronchery
399*e7be843bSPierre Pronchery end:
400*e7be843bSPierre Pronchery OPENSSL_free(fmt_slots);
401*e7be843bSPierre Pronchery if (ret == 0)
402*e7be843bSPierre Pronchery OPENSSL_free(buf);
403*e7be843bSPierre Pronchery return ret;
404*e7be843bSPierre Pronchery }
405*e7be843bSPierre Pronchery
ossl_ml_dsa_key_to_text(BIO * out,const ML_DSA_KEY * key,int selection)406*e7be843bSPierre Pronchery int ossl_ml_dsa_key_to_text(BIO *out, const ML_DSA_KEY *key, int selection)
407*e7be843bSPierre Pronchery {
408*e7be843bSPierre Pronchery const ML_DSA_PARAMS *params;
409*e7be843bSPierre Pronchery const uint8_t *seed, *sk, *pk;
410*e7be843bSPierre Pronchery
411*e7be843bSPierre Pronchery if (out == NULL || key == NULL) {
412*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER);
413*e7be843bSPierre Pronchery return 0;
414*e7be843bSPierre Pronchery }
415*e7be843bSPierre Pronchery params = ossl_ml_dsa_key_params(key);
416*e7be843bSPierre Pronchery pk = ossl_ml_dsa_key_get_pub(key);
417*e7be843bSPierre Pronchery sk = ossl_ml_dsa_key_get_priv(key);
418*e7be843bSPierre Pronchery seed = ossl_ml_dsa_key_get_seed(key);
419*e7be843bSPierre Pronchery
420*e7be843bSPierre Pronchery if (pk == NULL) {
421*e7be843bSPierre Pronchery /* Regardless of the |selection|, there must be a public key */
422*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY,
423*e7be843bSPierre Pronchery "no %s key material available", params->alg);
424*e7be843bSPierre Pronchery return 0;
425*e7be843bSPierre Pronchery }
426*e7be843bSPierre Pronchery
427*e7be843bSPierre Pronchery if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
428*e7be843bSPierre Pronchery if (sk == NULL) {
429*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY,
430*e7be843bSPierre Pronchery "no %s key material available", params->alg);
431*e7be843bSPierre Pronchery return 0;
432*e7be843bSPierre Pronchery }
433*e7be843bSPierre Pronchery if (BIO_printf(out, "%s Private-Key:\n", params->alg) <= 0)
434*e7be843bSPierre Pronchery return 0;
435*e7be843bSPierre Pronchery if (seed != NULL && !ossl_bio_print_labeled_buf(out, "seed:", seed,
436*e7be843bSPierre Pronchery ML_DSA_SEED_BYTES))
437*e7be843bSPierre Pronchery return 0;
438*e7be843bSPierre Pronchery if (!ossl_bio_print_labeled_buf(out, "priv:", sk, params->sk_len))
439*e7be843bSPierre Pronchery return 0;
440*e7be843bSPierre Pronchery } else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
441*e7be843bSPierre Pronchery if (BIO_printf(out, "%s Public-Key:\n", params->alg) <= 0)
442*e7be843bSPierre Pronchery return 0;
443*e7be843bSPierre Pronchery }
444*e7be843bSPierre Pronchery
445*e7be843bSPierre Pronchery if (!ossl_bio_print_labeled_buf(out, "pub:", pk, params->pk_len))
446*e7be843bSPierre Pronchery return 0;
447*e7be843bSPierre Pronchery
448*e7be843bSPierre Pronchery return 1;
449*e7be843bSPierre Pronchery }
450