1 /* 2 * Copyright 2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <string.h> 11 #include <openssl/byteorder.h> 12 #include <openssl/err.h> 13 #include <openssl/proverr.h> 14 #include <openssl/x509.h> 15 #include <openssl/core_names.h> 16 #include "internal/encoder.h" 17 #include "prov/ml_dsa.h" 18 #include "ml_dsa_codecs.h" 19 20 /*- 21 * Tables describing supported ASN.1 input/output formats. 22 */ 23 24 /*- 25 * ML-DSA-44: 26 * Public key bytes: 1312 (0x0520) 27 * Private key bytes: 2560 (0x0a00) 28 */ 29 static const ML_COMMON_SPKI_FMT ml_dsa_44_spkifmt = { 30 { 0x30, 0x82, 0x05, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 31 0x01, 0x65, 0x03, 0x04, 0x03, 0x11, 0x03, 0x82, 0x05, 0x21, 0x00, } 32 }; 33 static const ML_COMMON_PKCS8_FMT ml_dsa_44_p8fmt[NUM_PKCS8_FORMATS] = { 34 { "seed-priv", 0x0a2a, 0, 0x30820a26, 0x0420, 6, 0x20, 0x04820a00, 0x2a, 0x0a00, 0, 0, }, 35 { "priv-only", 0x0a04, 0, 0x04820a00, 0, 0, 0, 0, 0x04, 0x0a00, 0, 0, }, 36 { "oqskeypair", 0x0f24, 0, 0x04820f20, 0, 0, 0, 0, 0x04, 0x0a00, 0x0a04, 0x0520 }, 37 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, }, 38 { "bare-priv", 0x0a00, 4, 0, 0, 0, 0, 0, 0, 0x0a00, 0, 0, }, 39 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, }, 40 }; 41 42 /* 43 * ML-DSA-65: 44 * Public key bytes: 1952 (0x07a0) 45 * Private key bytes: 4032 (0x0fc0) 46 */ 47 static const ML_COMMON_SPKI_FMT ml_dsa_65_spkifmt = { 48 { 0x30, 0x82, 0x07, 0xb2, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 49 0x01, 0x65, 0x03, 0x04, 0x03, 0x12, 0x03, 0x82, 0x07, 0xa1, 0x00, } 50 }; 51 static const ML_COMMON_PKCS8_FMT ml_dsa_65_p8fmt[NUM_PKCS8_FORMATS] = { 52 { "seed-priv", 0x0fea, 0, 0x30820fe6, 0x0420, 6, 0x20, 0x04820fc0, 0x2a, 0x0fc0, 0, 0, }, 53 { "priv-only", 0x0fc4, 0, 0x04820fc0, 0, 0, 0, 0, 0x04, 0x0fc0, 0, 0, }, 54 { "oqskeypair", 0x1764, 0, 0x04821760, 0, 0, 0, 0, 0x04, 0x0fc0, 0x0fc4, 0x07a0 }, 55 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, }, 56 { "bare-priv", 0x0fc0, 4, 0, 0, 0, 0, 0, 0, 0x0fc0, 0, 0, }, 57 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, }, 58 }; 59 60 /*- 61 * ML-DSA-87: 62 * Public key bytes: 2592 (0x0a20) 63 * Private key bytes: 4896 (0x1320) 64 */ 65 static const ML_COMMON_SPKI_FMT ml_dsa_87_spkifmt = { 66 { 0x30, 0x82, 0x0a, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 67 0x01, 0x65, 0x03, 0x04, 0x03, 0x13, 0x03, 0x82, 0x0a, 0x21, 0x00, } 68 }; 69 static const ML_COMMON_PKCS8_FMT ml_dsa_87_p8fmt[NUM_PKCS8_FORMATS] = { 70 { "seed-priv", 0x134a, 0, 0x30821346, 0x0420, 6, 0x20, 0x04821320, 0x2a, 0x1320, 0, 0, }, 71 { "priv-only", 0x1324, 0, 0x04821320, 0, 0, 0, 0, 0x04, 0x1320, 0, 0, }, 72 { "oqskeypair", 0x1d44, 0, 0x04821d40, 0, 0, 0, 0, 0x04, 0x1320, 0x1324, 0x0a20 }, 73 { "seed-only", 0x0022, 2, 0x8020, 0, 2, 0x20, 0, 0, 0, 0, 0, }, 74 { "bare-priv", 0x1320, 4, 0, 0, 0, 0, 0, 0, 0x1320, 0, 0, }, 75 { "bare-seed", 0x0020, 4, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, }, 76 }; 77 78 /* Indices of slots in the codec table below */ 79 #define ML_DSA_44_CODEC 0 80 #define ML_DSA_65_CODEC 1 81 #define ML_DSA_87_CODEC 2 82 83 /* 84 * Per-variant fixed parameters 85 */ 86 static const ML_COMMON_CODEC codecs[3] = { 87 { &ml_dsa_44_spkifmt, ml_dsa_44_p8fmt }, 88 { &ml_dsa_65_spkifmt, ml_dsa_65_p8fmt }, 89 { &ml_dsa_87_spkifmt, ml_dsa_87_p8fmt } 90 }; 91 92 /* Retrieve the parameters of one of the ML-DSA variants */ 93 static const ML_COMMON_CODEC *ml_dsa_get_codec(int evp_type) 94 { 95 switch (evp_type) { 96 case EVP_PKEY_ML_DSA_44: 97 return &codecs[ML_DSA_44_CODEC]; 98 case EVP_PKEY_ML_DSA_65: 99 return &codecs[ML_DSA_65_CODEC]; 100 case EVP_PKEY_ML_DSA_87: 101 return &codecs[ML_DSA_87_CODEC]; 102 } 103 return NULL; 104 } 105 106 ML_DSA_KEY * 107 ossl_ml_dsa_d2i_PUBKEY(const uint8_t *pk, int pk_len, int evp_type, 108 PROV_CTX *provctx, const char *propq) 109 { 110 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx); 111 const ML_COMMON_CODEC *codec; 112 const ML_DSA_PARAMS *params; 113 ML_DSA_KEY *ret; 114 115 if ((params = ossl_ml_dsa_params_get(evp_type)) == NULL 116 || (codec = ml_dsa_get_codec(evp_type)) == NULL) 117 return NULL; 118 if (pk_len != ML_COMMON_SPKI_OVERHEAD + (ossl_ssize_t) params->pk_len 119 || memcmp(pk, codec->spkifmt->asn1_prefix, ML_COMMON_SPKI_OVERHEAD) != 0) 120 return NULL; 121 pk_len -= ML_COMMON_SPKI_OVERHEAD; 122 pk += ML_COMMON_SPKI_OVERHEAD; 123 124 if ((ret = ossl_ml_dsa_key_new(libctx, propq, evp_type)) == NULL) 125 return NULL; 126 127 if (!ossl_ml_dsa_pk_decode(ret, pk, (size_t) pk_len)) { 128 ERR_raise_data(ERR_LIB_PROV, PROV_R_BAD_ENCODING, 129 "errror parsing %s public key from input SPKI", 130 params->alg); 131 ossl_ml_dsa_key_free(ret); 132 return NULL; 133 } 134 135 return ret; 136 } 137 138 ML_DSA_KEY * 139 ossl_ml_dsa_d2i_PKCS8(const uint8_t *prvenc, int prvlen, 140 int evp_type, PROV_CTX *provctx, 141 const char *propq) 142 { 143 const ML_DSA_PARAMS *v; 144 const ML_COMMON_CODEC *codec; 145 ML_COMMON_PKCS8_FMT_PREF *fmt_slots = NULL, *slot; 146 const ML_COMMON_PKCS8_FMT *p8fmt; 147 ML_DSA_KEY *key = NULL, *ret = NULL; 148 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 149 const uint8_t *buf, *pos; 150 const X509_ALGOR *alg = NULL; 151 const char *formats; 152 int len, ptype; 153 uint32_t magic; 154 uint16_t seed_magic; 155 const uint8_t *seed = NULL; 156 const uint8_t *priv = NULL; 157 158 /* Which ML-DSA variant? */ 159 if ((v = ossl_ml_dsa_params_get(evp_type)) == NULL 160 || (codec = ml_dsa_get_codec(evp_type)) == NULL) 161 return 0; 162 163 /* Extract the key OID and any parameters. */ 164 if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &prvenc, prvlen)) == NULL) 165 return 0; 166 /* Shortest prefix is 4 bytes: seq tag/len + octet string tag/len */ 167 if (!PKCS8_pkey_get0(NULL, &buf, &len, &alg, p8inf)) 168 goto end; 169 /* Bail out early if this is some other key type. */ 170 if (OBJ_obj2nid(alg->algorithm) != evp_type) 171 goto end; 172 173 /* Get the list of enabled decoders. Their order is not important here. */ 174 formats = ossl_prov_ctx_get_param( 175 provctx, OSSL_PKEY_PARAM_ML_DSA_INPUT_FORMATS, NULL); 176 fmt_slots = ossl_ml_common_pkcs8_fmt_order(v->alg, codec->p8fmt, 177 "input", formats); 178 if (fmt_slots == NULL) 179 goto end; 180 181 /* Parameters must be absent. */ 182 X509_ALGOR_get0(NULL, &ptype, NULL, alg); 183 if (ptype != V_ASN1_UNDEF) { 184 ERR_raise_data(ERR_LIB_PROV, PROV_R_UNEXPECTED_KEY_PARAMETERS, 185 "unexpected parameters with a PKCS#8 %s private key", 186 v->alg); 187 goto end; 188 } 189 if ((ossl_ssize_t)len < (ossl_ssize_t)sizeof(magic)) 190 goto end; 191 192 /* Find the matching p8 info slot, that also has the expected length. */ 193 pos = OPENSSL_load_u32_be(&magic, buf); 194 for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot) { 195 if (len != (ossl_ssize_t)p8fmt->p8_bytes) 196 continue; 197 if (p8fmt->p8_shift == sizeof(magic) 198 || (magic >> (p8fmt->p8_shift * 8)) == p8fmt->p8_magic) { 199 pos -= p8fmt->p8_shift; 200 break; 201 } 202 } 203 if (p8fmt == NULL 204 || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES) 205 || (p8fmt->priv_length > 0 && p8fmt->priv_length != v->sk_len) 206 || (p8fmt->pub_length > 0 && p8fmt->pub_length != v->pk_len)) { 207 ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT, 208 "no matching enabled %s private key input formats", 209 v->alg); 210 goto end; 211 } 212 213 if (p8fmt->seed_length > 0) { 214 /* Check |seed| tag/len, if not subsumed by |magic|. */ 215 if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset) { 216 pos = OPENSSL_load_u16_be(&seed_magic, pos); 217 if (seed_magic != p8fmt->seed_magic) 218 goto end; 219 } else if (pos != buf + p8fmt->seed_offset) { 220 goto end; 221 } 222 pos += ML_DSA_SEED_BYTES; 223 } 224 if (p8fmt->priv_length > 0) { 225 /* Check |priv| tag/len */ 226 if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset) { 227 pos = OPENSSL_load_u32_be(&magic, pos); 228 if (magic != p8fmt->priv_magic) 229 goto end; 230 } else if (pos != buf + p8fmt->priv_offset) { 231 goto end; 232 } 233 pos += v->sk_len; 234 } 235 if (p8fmt->pub_length > 0) { 236 if (pos != buf + p8fmt->pub_offset) 237 goto end; 238 pos += v->pk_len; 239 } 240 if (pos != buf + len) 241 goto end; 242 243 /* 244 * Collect the seed and/or key into a "decoded" private key object, 245 * to be turned into a real key on provider "load" or "import". 246 */ 247 if ((key = ossl_prov_ml_dsa_new(provctx, propq, evp_type)) == NULL) 248 goto end; 249 if (p8fmt->seed_length > 0) 250 seed = buf + p8fmt->seed_offset; 251 if (p8fmt->priv_length > 0) 252 priv = buf + p8fmt->priv_offset; 253 /* Any OQS public key content is ignored */ 254 255 if (ossl_ml_dsa_set_prekey(key, 0, 0, 256 seed, ML_DSA_SEED_BYTES, priv, v->sk_len)) 257 ret = key; 258 259 end: 260 OPENSSL_free(fmt_slots); 261 PKCS8_PRIV_KEY_INFO_free(p8inf); 262 if (ret == NULL) 263 ossl_ml_dsa_key_free(key); 264 return ret; 265 } 266 267 /* Same as ossl_ml_dsa_encode_pubkey, but allocates the output buffer. */ 268 int ossl_ml_dsa_i2d_pubkey(const ML_DSA_KEY *key, unsigned char **out) 269 { 270 const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key); 271 const uint8_t *pk = ossl_ml_dsa_key_get_pub(key); 272 273 if (pk == NULL) { 274 ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PUBLIC_KEY, 275 "no %s public key data available", params->alg); 276 return 0; 277 } 278 if (out != NULL 279 && (*out = OPENSSL_memdup(pk, params->pk_len)) == NULL) 280 return 0; 281 return (int)params->pk_len; 282 } 283 284 /* Allocate and encode PKCS#8 private key payload. */ 285 int ossl_ml_dsa_i2d_prvkey(const ML_DSA_KEY *key, uint8_t **out, 286 PROV_CTX *provctx) 287 { 288 const ML_DSA_PARAMS *params = ossl_ml_dsa_key_params(key); 289 const ML_COMMON_CODEC *codec; 290 ML_COMMON_PKCS8_FMT_PREF *fmt_slots, *slot; 291 const ML_COMMON_PKCS8_FMT *p8fmt; 292 uint8_t *buf = NULL, *pos; 293 const char *formats; 294 int len = ML_DSA_SEED_BYTES; 295 int ret = 0; 296 const uint8_t *seed = ossl_ml_dsa_key_get_seed(key); 297 const uint8_t *sk = ossl_ml_dsa_key_get_priv(key); 298 299 /* Not ours to handle */ 300 if ((codec = ml_dsa_get_codec(params->evp_type)) == NULL) 301 return 0; 302 303 if (sk == NULL) { 304 ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PRIVATE_KEY, 305 "no %s private key data available", 306 params->alg); 307 return 0; 308 } 309 310 formats = ossl_prov_ctx_get_param( 311 provctx, OSSL_PKEY_PARAM_ML_DSA_OUTPUT_FORMATS, NULL); 312 fmt_slots = ossl_ml_common_pkcs8_fmt_order(params->alg, codec->p8fmt, 313 "output", formats); 314 if (fmt_slots == NULL) 315 return 0; 316 317 /* If we don't have a seed, skip seedful entries */ 318 for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot) 319 if (seed != NULL || p8fmt->seed_length == 0) 320 break; 321 /* No matching table entries, give up */ 322 if (p8fmt == NULL 323 || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_DSA_SEED_BYTES) 324 || (p8fmt->priv_length > 0 && p8fmt->priv_length != params->sk_len) 325 || (p8fmt->pub_length > 0 && p8fmt->pub_length != params->pk_len)) { 326 ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_DSA_NO_FORMAT, 327 "no matching enabled %s private key output formats", 328 params->alg); 329 goto end; 330 } 331 len = p8fmt->p8_bytes; 332 333 if (out == NULL) { 334 ret = len; 335 goto end; 336 } 337 338 if ((pos = buf = OPENSSL_malloc((size_t) len)) == NULL) 339 goto end; 340 341 switch (p8fmt->p8_shift) { 342 case 0: 343 pos = OPENSSL_store_u32_be(pos, p8fmt->p8_magic); 344 break; 345 case 2: 346 pos = OPENSSL_store_u16_be(pos, (uint16_t)p8fmt->p8_magic); 347 break; 348 case 4: 349 break; 350 default: 351 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR, 352 "error encoding %s private key", params->alg); 353 goto end; 354 } 355 356 if (p8fmt->seed_length != 0) { 357 /* 358 * Either the tag/len were already included in |magic| or they require 359 * us to write two bytes now. 360 */ 361 if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset) 362 pos = OPENSSL_store_u16_be(pos, p8fmt->seed_magic); 363 if (pos != buf + p8fmt->seed_offset) { 364 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR, 365 "error encoding %s private key", params->alg); 366 goto end; 367 } 368 memcpy(pos, seed, ML_DSA_SEED_BYTES); 369 pos += ML_DSA_SEED_BYTES; 370 } 371 if (p8fmt->priv_length != 0) { 372 if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset) 373 pos = OPENSSL_store_u32_be(pos, p8fmt->priv_magic); 374 if (pos != buf + p8fmt->priv_offset) { 375 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR, 376 "error encoding %s private key", params->alg); 377 goto end; 378 } 379 memcpy(pos, sk, params->sk_len); 380 pos += params->sk_len; 381 } 382 /* OQS form output with tacked-on public key */ 383 if (p8fmt->pub_length != 0) { 384 /* The OQS pubkey is never separately DER-wrapped */ 385 if (pos != buf + p8fmt->pub_offset) { 386 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR, 387 "error encoding %s private key", params->alg); 388 goto end; 389 } 390 memcpy(pos, ossl_ml_dsa_key_get_pub(key), params->pk_len); 391 pos += params->pk_len; 392 } 393 394 if (pos == buf + len) { 395 *out = buf; 396 ret = len; 397 } 398 399 end: 400 OPENSSL_free(fmt_slots); 401 if (ret == 0) 402 OPENSSL_free(buf); 403 return ret; 404 } 405 406 int ossl_ml_dsa_key_to_text(BIO *out, const ML_DSA_KEY *key, int selection) 407 { 408 const ML_DSA_PARAMS *params; 409 const uint8_t *seed, *sk, *pk; 410 411 if (out == NULL || key == NULL) { 412 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER); 413 return 0; 414 } 415 params = ossl_ml_dsa_key_params(key); 416 pk = ossl_ml_dsa_key_get_pub(key); 417 sk = ossl_ml_dsa_key_get_priv(key); 418 seed = ossl_ml_dsa_key_get_seed(key); 419 420 if (pk == NULL) { 421 /* Regardless of the |selection|, there must be a public key */ 422 ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY, 423 "no %s key material available", params->alg); 424 return 0; 425 } 426 427 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { 428 if (sk == NULL) { 429 ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY, 430 "no %s key material available", params->alg); 431 return 0; 432 } 433 if (BIO_printf(out, "%s Private-Key:\n", params->alg) <= 0) 434 return 0; 435 if (seed != NULL && !ossl_bio_print_labeled_buf(out, "seed:", seed, 436 ML_DSA_SEED_BYTES)) 437 return 0; 438 if (!ossl_bio_print_labeled_buf(out, "priv:", sk, params->sk_len)) 439 return 0; 440 } else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { 441 if (BIO_printf(out, "%s Public-Key:\n", params->alg) <= 0) 442 return 0; 443 } 444 445 if (!ossl_bio_print_labeled_buf(out, "pub:", pk, params->pk_len)) 446 return 0; 447 448 return 1; 449 } 450