1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery #include <string.h>
11*e7be843bSPierre Pronchery #include <openssl/byteorder.h>
12*e7be843bSPierre Pronchery #include <openssl/proverr.h>
13*e7be843bSPierre Pronchery #include <openssl/x509.h>
14*e7be843bSPierre Pronchery #include <openssl/core_names.h>
15*e7be843bSPierre Pronchery #include "internal/encoder.h"
16*e7be843bSPierre Pronchery #include "prov/ml_kem.h"
17*e7be843bSPierre Pronchery #include "ml_kem_codecs.h"
18*e7be843bSPierre Pronchery
19*e7be843bSPierre Pronchery /* Tables describing supported ASN.1 input/output formats. */
20*e7be843bSPierre Pronchery
21*e7be843bSPierre Pronchery /*-
22*e7be843bSPierre Pronchery * ML-KEM-512:
23*e7be843bSPierre Pronchery * Public key bytes: 800 (0x0320)
24*e7be843bSPierre Pronchery * Private key bytes: 1632 (0x0660)
25*e7be843bSPierre Pronchery */
26*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_kem_512_spkifmt = {
27*e7be843bSPierre Pronchery { 0x30, 0x82, 0x03, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
28*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x04, 0x01, 0x03, 0x82, 0x03, 0x21, 0x00, }
29*e7be843bSPierre Pronchery };
30*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_kem_512_p8fmt[NUM_PKCS8_FORMATS] = {
31*e7be843bSPierre Pronchery { "seed-priv", 0x06aa, 0, 0x308206a6, 0x0440, 6, 0x40, 0x04820660, 0x4a, 0x0660, 0, 0 },
32*e7be843bSPierre Pronchery { "priv-only", 0x0664, 0, 0x04820660, 0, 0, 0, 0, 0x04, 0x0660, 0, 0 },
33*e7be843bSPierre Pronchery { "oqskeypair", 0x0984, 0, 0x04820980, 0, 0, 0, 0, 0x04, 0x0660, 0x0664, 0x0320 },
34*e7be843bSPierre Pronchery { "seed-only", 0x0042, 2, 0x8040, 0, 2, 0x40, 0, 0, 0, 0, 0 },
35*e7be843bSPierre Pronchery { "bare-priv", 0x0660, 4, 0, 0, 0, 0, 0, 0, 0x0660, 0, 0 },
36*e7be843bSPierre Pronchery { "bare-seed", 0x0040, 4, 0, 0, 0, 0x40, 0, 0, 0, 0, 0 },
37*e7be843bSPierre Pronchery };
38*e7be843bSPierre Pronchery
39*e7be843bSPierre Pronchery /*-
40*e7be843bSPierre Pronchery * ML-KEM-768:
41*e7be843bSPierre Pronchery * Public key bytes: 1184 (0x04a0)
42*e7be843bSPierre Pronchery * Private key bytes: 2400 (0x0960)
43*e7be843bSPierre Pronchery */
44*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_kem_768_spkifmt = {
45*e7be843bSPierre Pronchery { 0x30, 0x82, 0x04, 0xb2, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
46*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x04, 0x02, 0x03, 0x82, 0x04, 0xa1, 0x00, }
47*e7be843bSPierre Pronchery };
48*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_kem_768_p8fmt[NUM_PKCS8_FORMATS] = {
49*e7be843bSPierre Pronchery { "seed-priv", 0x09aa, 0, 0x308209a6, 0x0440, 6, 0x40, 0x04820960, 0x4a, 0x0960, 0, 0, },
50*e7be843bSPierre Pronchery { "priv-only", 0x0964, 0, 0x04820960, 0, 0, 0, 0, 0x04, 0x0960, 0, 0, },
51*e7be843bSPierre Pronchery { "oqskeypair", 0x0e04, 0, 0x04820e00, 0, 0, 0, 0, 0x04, 0x0960, 0x0964, 0x04a0 },
52*e7be843bSPierre Pronchery { "seed-only", 0x0042, 2, 0x8040, 0, 2, 0x40, 0, 0, 0, 0, 0, },
53*e7be843bSPierre Pronchery { "bare-priv", 0x0960, 4, 0, 0, 0, 0, 0, 0, 0x0960, 0, 0, },
54*e7be843bSPierre Pronchery { "bare-seed", 0x0040, 4, 0, 0, 0, 0x40, 0, 0, 0, 0, 0, },
55*e7be843bSPierre Pronchery };
56*e7be843bSPierre Pronchery
57*e7be843bSPierre Pronchery /*-
58*e7be843bSPierre Pronchery * ML-KEM-1024:
59*e7be843bSPierre Pronchery * Private key bytes: 3168 (0x0c60)
60*e7be843bSPierre Pronchery * Public key bytes: 1568 (0x0620)
61*e7be843bSPierre Pronchery */
62*e7be843bSPierre Pronchery static const ML_COMMON_SPKI_FMT ml_kem_1024_spkifmt = {
63*e7be843bSPierre Pronchery { 0x30, 0x82, 0x06, 0x32, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48,
64*e7be843bSPierre Pronchery 0x01, 0x65, 0x03, 0x04, 0x04, 0x03, 0x03, 0x82, 0x06, 0x21, 0x00, }
65*e7be843bSPierre Pronchery };
66*e7be843bSPierre Pronchery static const ML_COMMON_PKCS8_FMT ml_kem_1024_p8fmt[NUM_PKCS8_FORMATS] = {
67*e7be843bSPierre Pronchery { "seed-priv", 0x0caa, 0, 0x30820ca6, 0x0440, 6, 0x40, 0x04820c60, 0x4a, 0x0c60, 0, 0 },
68*e7be843bSPierre Pronchery { "priv-only", 0x0c64, 0, 0x04820c60, 0, 0, 0, 0, 0x04, 0x0c60, 0, 0 },
69*e7be843bSPierre Pronchery { "oqskeypair", 0x1284, 0, 0x04821280, 0, 0, 0, 0, 0x04, 0x0c60, 0x0c64, 0x0620 },
70*e7be843bSPierre Pronchery { "seed-only", 0x0042, 2, 0x8040, 0, 2, 0x40, 0, 0, 0, 0, 0 },
71*e7be843bSPierre Pronchery { "bare-priv", 0x0c60, 4, 0, 0, 0, 0, 0, 0, 0x0c60, 0, 0 },
72*e7be843bSPierre Pronchery { "bare-seed", 0x0040, 4, 0, 0, 0, 0x40, 0, 0, 0, 0, 0 },
73*e7be843bSPierre Pronchery };
74*e7be843bSPierre Pronchery
75*e7be843bSPierre Pronchery /* Indices of slots in the `codecs` table below */
76*e7be843bSPierre Pronchery #define ML_KEM_512_CODEC 0
77*e7be843bSPierre Pronchery #define ML_KEM_768_CODEC 1
78*e7be843bSPierre Pronchery #define ML_KEM_1024_CODEC 2
79*e7be843bSPierre Pronchery
80*e7be843bSPierre Pronchery /*
81*e7be843bSPierre Pronchery * Per-variant fixed parameters
82*e7be843bSPierre Pronchery */
83*e7be843bSPierre Pronchery static const ML_COMMON_CODEC codecs[3] = {
84*e7be843bSPierre Pronchery { &ml_kem_512_spkifmt, ml_kem_512_p8fmt },
85*e7be843bSPierre Pronchery { &ml_kem_768_spkifmt, ml_kem_768_p8fmt },
86*e7be843bSPierre Pronchery { &ml_kem_1024_spkifmt, ml_kem_1024_p8fmt }
87*e7be843bSPierre Pronchery };
88*e7be843bSPierre Pronchery
89*e7be843bSPierre Pronchery /* Retrieve the parameters of one of the ML-KEM variants */
ml_kem_get_codec(int evp_type)90*e7be843bSPierre Pronchery static const ML_COMMON_CODEC *ml_kem_get_codec(int evp_type)
91*e7be843bSPierre Pronchery {
92*e7be843bSPierre Pronchery switch (evp_type) {
93*e7be843bSPierre Pronchery case EVP_PKEY_ML_KEM_512:
94*e7be843bSPierre Pronchery return &codecs[ML_KEM_512_CODEC];
95*e7be843bSPierre Pronchery case EVP_PKEY_ML_KEM_768:
96*e7be843bSPierre Pronchery return &codecs[ML_KEM_768_CODEC];
97*e7be843bSPierre Pronchery case EVP_PKEY_ML_KEM_1024:
98*e7be843bSPierre Pronchery return &codecs[ML_KEM_1024_CODEC];
99*e7be843bSPierre Pronchery }
100*e7be843bSPierre Pronchery return NULL;
101*e7be843bSPierre Pronchery }
102*e7be843bSPierre Pronchery
103*e7be843bSPierre Pronchery ML_KEM_KEY *
ossl_ml_kem_d2i_PUBKEY(const uint8_t * pubenc,int publen,int evp_type,PROV_CTX * provctx,const char * propq)104*e7be843bSPierre Pronchery ossl_ml_kem_d2i_PUBKEY(const uint8_t *pubenc, int publen, int evp_type,
105*e7be843bSPierre Pronchery PROV_CTX *provctx, const char *propq)
106*e7be843bSPierre Pronchery {
107*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);
108*e7be843bSPierre Pronchery const ML_KEM_VINFO *v;
109*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
110*e7be843bSPierre Pronchery const ML_COMMON_SPKI_FMT *vspki;
111*e7be843bSPierre Pronchery ML_KEM_KEY *ret;
112*e7be843bSPierre Pronchery
113*e7be843bSPierre Pronchery if ((v = ossl_ml_kem_get_vinfo(evp_type)) == NULL
114*e7be843bSPierre Pronchery || (codec = ml_kem_get_codec(evp_type)) == NULL)
115*e7be843bSPierre Pronchery return NULL;
116*e7be843bSPierre Pronchery vspki = codec->spkifmt;
117*e7be843bSPierre Pronchery if (publen != ML_COMMON_SPKI_OVERHEAD + (ossl_ssize_t) v->pubkey_bytes
118*e7be843bSPierre Pronchery || memcmp(pubenc, vspki->asn1_prefix, ML_COMMON_SPKI_OVERHEAD) != 0)
119*e7be843bSPierre Pronchery return NULL;
120*e7be843bSPierre Pronchery publen -= ML_COMMON_SPKI_OVERHEAD;
121*e7be843bSPierre Pronchery pubenc += ML_COMMON_SPKI_OVERHEAD;
122*e7be843bSPierre Pronchery
123*e7be843bSPierre Pronchery if ((ret = ossl_ml_kem_key_new(libctx, propq, evp_type)) == NULL)
124*e7be843bSPierre Pronchery return NULL;
125*e7be843bSPierre Pronchery
126*e7be843bSPierre Pronchery if (!ossl_ml_kem_parse_public_key(pubenc, (size_t) publen, ret)) {
127*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_BAD_ENCODING,
128*e7be843bSPierre Pronchery "errror parsing %s public key from input SPKI",
129*e7be843bSPierre Pronchery v->algorithm_name);
130*e7be843bSPierre Pronchery ossl_ml_kem_key_free(ret);
131*e7be843bSPierre Pronchery return NULL;
132*e7be843bSPierre Pronchery }
133*e7be843bSPierre Pronchery
134*e7be843bSPierre Pronchery return ret;
135*e7be843bSPierre Pronchery }
136*e7be843bSPierre Pronchery
137*e7be843bSPierre Pronchery ML_KEM_KEY *
ossl_ml_kem_d2i_PKCS8(const uint8_t * prvenc,int prvlen,int evp_type,PROV_CTX * provctx,const char * propq)138*e7be843bSPierre Pronchery ossl_ml_kem_d2i_PKCS8(const uint8_t *prvenc, int prvlen,
139*e7be843bSPierre Pronchery int evp_type, PROV_CTX *provctx,
140*e7be843bSPierre Pronchery const char *propq)
141*e7be843bSPierre Pronchery {
142*e7be843bSPierre Pronchery const ML_KEM_VINFO *v;
143*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
144*e7be843bSPierre Pronchery ML_COMMON_PKCS8_FMT_PREF *fmt_slots = NULL, *slot;
145*e7be843bSPierre Pronchery const ML_COMMON_PKCS8_FMT *p8fmt;
146*e7be843bSPierre Pronchery ML_KEM_KEY *key = NULL, *ret = NULL;
147*e7be843bSPierre Pronchery PKCS8_PRIV_KEY_INFO *p8inf = NULL;
148*e7be843bSPierre Pronchery const uint8_t *buf, *pos;
149*e7be843bSPierre Pronchery const X509_ALGOR *alg = NULL;
150*e7be843bSPierre Pronchery const char *formats;
151*e7be843bSPierre Pronchery int len, ptype;
152*e7be843bSPierre Pronchery uint32_t magic;
153*e7be843bSPierre Pronchery uint16_t seed_magic;
154*e7be843bSPierre Pronchery
155*e7be843bSPierre Pronchery /* Which ML-KEM variant? */
156*e7be843bSPierre Pronchery if ((v = ossl_ml_kem_get_vinfo(evp_type)) == NULL
157*e7be843bSPierre Pronchery || (codec = ml_kem_get_codec(evp_type)) == NULL)
158*e7be843bSPierre Pronchery return 0;
159*e7be843bSPierre Pronchery
160*e7be843bSPierre Pronchery /* Extract the key OID and any parameters. */
161*e7be843bSPierre Pronchery if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &prvenc, prvlen)) == NULL)
162*e7be843bSPierre Pronchery return 0;
163*e7be843bSPierre Pronchery /* Shortest prefix is 4 bytes: seq tag/len + octet string tag/len */
164*e7be843bSPierre Pronchery if (!PKCS8_pkey_get0(NULL, &buf, &len, &alg, p8inf))
165*e7be843bSPierre Pronchery goto end;
166*e7be843bSPierre Pronchery /* Bail out early if this is some other key type. */
167*e7be843bSPierre Pronchery if (OBJ_obj2nid(alg->algorithm) != evp_type)
168*e7be843bSPierre Pronchery goto end;
169*e7be843bSPierre Pronchery
170*e7be843bSPierre Pronchery /* Get the list of enabled decoders. Their order is not important here. */
171*e7be843bSPierre Pronchery formats = ossl_prov_ctx_get_param(
172*e7be843bSPierre Pronchery provctx, OSSL_PKEY_PARAM_ML_KEM_INPUT_FORMATS, NULL);
173*e7be843bSPierre Pronchery fmt_slots = ossl_ml_common_pkcs8_fmt_order(v->algorithm_name, codec->p8fmt,
174*e7be843bSPierre Pronchery "input", formats);
175*e7be843bSPierre Pronchery if (fmt_slots == NULL)
176*e7be843bSPierre Pronchery goto end;
177*e7be843bSPierre Pronchery
178*e7be843bSPierre Pronchery /* Parameters must be absent. */
179*e7be843bSPierre Pronchery X509_ALGOR_get0(NULL, &ptype, NULL, alg);
180*e7be843bSPierre Pronchery if (ptype != V_ASN1_UNDEF) {
181*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_UNEXPECTED_KEY_PARAMETERS,
182*e7be843bSPierre Pronchery "unexpected parameters with a PKCS#8 %s private key",
183*e7be843bSPierre Pronchery v->algorithm_name);
184*e7be843bSPierre Pronchery goto end;
185*e7be843bSPierre Pronchery }
186*e7be843bSPierre Pronchery if ((ossl_ssize_t)len < (ossl_ssize_t)sizeof(magic))
187*e7be843bSPierre Pronchery goto end;
188*e7be843bSPierre Pronchery
189*e7be843bSPierre Pronchery /* Find the matching p8 info slot, that also has the expected length. */
190*e7be843bSPierre Pronchery pos = OPENSSL_load_u32_be(&magic, buf);
191*e7be843bSPierre Pronchery for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot) {
192*e7be843bSPierre Pronchery if (len != (ossl_ssize_t)p8fmt->p8_bytes)
193*e7be843bSPierre Pronchery continue;
194*e7be843bSPierre Pronchery if (p8fmt->p8_shift == sizeof(magic)
195*e7be843bSPierre Pronchery || (magic >> (p8fmt->p8_shift * 8)) == p8fmt->p8_magic) {
196*e7be843bSPierre Pronchery pos -= p8fmt->p8_shift;
197*e7be843bSPierre Pronchery break;
198*e7be843bSPierre Pronchery }
199*e7be843bSPierre Pronchery }
200*e7be843bSPierre Pronchery if (p8fmt == NULL
201*e7be843bSPierre Pronchery || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_KEM_SEED_BYTES)
202*e7be843bSPierre Pronchery || (p8fmt->priv_length > 0 && p8fmt->priv_length != v->prvkey_bytes)
203*e7be843bSPierre Pronchery || (p8fmt->pub_length > 0 && p8fmt->pub_length != v->pubkey_bytes)) {
204*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_KEM_NO_FORMAT,
205*e7be843bSPierre Pronchery "no matching enabled %s private key input formats",
206*e7be843bSPierre Pronchery v->algorithm_name);
207*e7be843bSPierre Pronchery goto end;
208*e7be843bSPierre Pronchery }
209*e7be843bSPierre Pronchery
210*e7be843bSPierre Pronchery if (p8fmt->seed_length > 0) {
211*e7be843bSPierre Pronchery /* Check |seed| tag/len, if not subsumed by |magic|. */
212*e7be843bSPierre Pronchery if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset) {
213*e7be843bSPierre Pronchery pos = OPENSSL_load_u16_be(&seed_magic, pos);
214*e7be843bSPierre Pronchery if (seed_magic != p8fmt->seed_magic)
215*e7be843bSPierre Pronchery goto end;
216*e7be843bSPierre Pronchery } else if (pos != buf + p8fmt->seed_offset) {
217*e7be843bSPierre Pronchery goto end;
218*e7be843bSPierre Pronchery }
219*e7be843bSPierre Pronchery pos += ML_KEM_SEED_BYTES;
220*e7be843bSPierre Pronchery }
221*e7be843bSPierre Pronchery if (p8fmt->priv_length > 0) {
222*e7be843bSPierre Pronchery /* Check |priv| tag/len */
223*e7be843bSPierre Pronchery if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset) {
224*e7be843bSPierre Pronchery pos = OPENSSL_load_u32_be(&magic, pos);
225*e7be843bSPierre Pronchery if (magic != p8fmt->priv_magic)
226*e7be843bSPierre Pronchery goto end;
227*e7be843bSPierre Pronchery } else if (pos != buf + p8fmt->priv_offset) {
228*e7be843bSPierre Pronchery goto end;
229*e7be843bSPierre Pronchery }
230*e7be843bSPierre Pronchery pos += v->prvkey_bytes;
231*e7be843bSPierre Pronchery }
232*e7be843bSPierre Pronchery if (p8fmt->pub_length > 0) {
233*e7be843bSPierre Pronchery if (pos != buf + p8fmt->pub_offset)
234*e7be843bSPierre Pronchery goto end;
235*e7be843bSPierre Pronchery pos += v->pubkey_bytes;
236*e7be843bSPierre Pronchery }
237*e7be843bSPierre Pronchery if (pos != buf + len)
238*e7be843bSPierre Pronchery goto end;
239*e7be843bSPierre Pronchery
240*e7be843bSPierre Pronchery /*
241*e7be843bSPierre Pronchery * Collect the seed and/or key into a "decoded" private key object,
242*e7be843bSPierre Pronchery * to be turned into a real key on provider "load" or "import".
243*e7be843bSPierre Pronchery */
244*e7be843bSPierre Pronchery if ((key = ossl_prov_ml_kem_new(provctx, propq, evp_type)) == NULL)
245*e7be843bSPierre Pronchery goto end;
246*e7be843bSPierre Pronchery
247*e7be843bSPierre Pronchery if (p8fmt->seed_length > 0) {
248*e7be843bSPierre Pronchery if (!ossl_ml_kem_set_seed(buf + p8fmt->seed_offset,
249*e7be843bSPierre Pronchery ML_KEM_SEED_BYTES, key)) {
250*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR,
251*e7be843bSPierre Pronchery "error storing %s private key seed",
252*e7be843bSPierre Pronchery v->algorithm_name);
253*e7be843bSPierre Pronchery goto end;
254*e7be843bSPierre Pronchery }
255*e7be843bSPierre Pronchery }
256*e7be843bSPierre Pronchery if (p8fmt->priv_length > 0) {
257*e7be843bSPierre Pronchery if ((key->encoded_dk = OPENSSL_malloc(p8fmt->priv_length)) == NULL) {
258*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY,
259*e7be843bSPierre Pronchery "error parsing %s private key",
260*e7be843bSPierre Pronchery v->algorithm_name);
261*e7be843bSPierre Pronchery goto end;
262*e7be843bSPierre Pronchery }
263*e7be843bSPierre Pronchery memcpy(key->encoded_dk, buf + p8fmt->priv_offset, p8fmt->priv_length);
264*e7be843bSPierre Pronchery }
265*e7be843bSPierre Pronchery /* Any OQS public key content is ignored */
266*e7be843bSPierre Pronchery ret = key;
267*e7be843bSPierre Pronchery
268*e7be843bSPierre Pronchery end:
269*e7be843bSPierre Pronchery OPENSSL_free(fmt_slots);
270*e7be843bSPierre Pronchery PKCS8_PRIV_KEY_INFO_free(p8inf);
271*e7be843bSPierre Pronchery if (ret == NULL)
272*e7be843bSPierre Pronchery ossl_ml_kem_key_free(key);
273*e7be843bSPierre Pronchery return ret;
274*e7be843bSPierre Pronchery }
275*e7be843bSPierre Pronchery
276*e7be843bSPierre Pronchery /* Same as ossl_ml_kem_encode_pubkey, but allocates the output buffer. */
ossl_ml_kem_i2d_pubkey(const ML_KEM_KEY * key,unsigned char ** out)277*e7be843bSPierre Pronchery int ossl_ml_kem_i2d_pubkey(const ML_KEM_KEY *key, unsigned char **out)
278*e7be843bSPierre Pronchery {
279*e7be843bSPierre Pronchery size_t publen;
280*e7be843bSPierre Pronchery
281*e7be843bSPierre Pronchery if (!ossl_ml_kem_have_pubkey(key)) {
282*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PUBLIC_KEY,
283*e7be843bSPierre Pronchery "no %s public key data available",
284*e7be843bSPierre Pronchery key->vinfo->algorithm_name);
285*e7be843bSPierre Pronchery return 0;
286*e7be843bSPierre Pronchery }
287*e7be843bSPierre Pronchery publen = key->vinfo->pubkey_bytes;
288*e7be843bSPierre Pronchery
289*e7be843bSPierre Pronchery if (out != NULL
290*e7be843bSPierre Pronchery && (*out = OPENSSL_malloc(publen)) == NULL)
291*e7be843bSPierre Pronchery return 0;
292*e7be843bSPierre Pronchery if (!ossl_ml_kem_encode_public_key(*out, publen, key)) {
293*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_OSSL_ENCODER, ERR_R_INTERNAL_ERROR,
294*e7be843bSPierre Pronchery "error encoding %s public key",
295*e7be843bSPierre Pronchery key->vinfo->algorithm_name);
296*e7be843bSPierre Pronchery OPENSSL_free(*out);
297*e7be843bSPierre Pronchery return 0;
298*e7be843bSPierre Pronchery }
299*e7be843bSPierre Pronchery
300*e7be843bSPierre Pronchery return (int)publen;
301*e7be843bSPierre Pronchery }
302*e7be843bSPierre Pronchery
303*e7be843bSPierre Pronchery /* Allocate and encode PKCS#8 private key payload. */
ossl_ml_kem_i2d_prvkey(const ML_KEM_KEY * key,uint8_t ** out,PROV_CTX * provctx)304*e7be843bSPierre Pronchery int ossl_ml_kem_i2d_prvkey(const ML_KEM_KEY *key, uint8_t **out,
305*e7be843bSPierre Pronchery PROV_CTX *provctx)
306*e7be843bSPierre Pronchery {
307*e7be843bSPierre Pronchery const ML_KEM_VINFO *v = key->vinfo;
308*e7be843bSPierre Pronchery const ML_COMMON_CODEC *codec;
309*e7be843bSPierre Pronchery ML_COMMON_PKCS8_FMT_PREF *fmt_slots, *slot;
310*e7be843bSPierre Pronchery const ML_COMMON_PKCS8_FMT *p8fmt;
311*e7be843bSPierre Pronchery uint8_t *buf = NULL, *pos;
312*e7be843bSPierre Pronchery const char *formats;
313*e7be843bSPierre Pronchery int len = ML_KEM_SEED_BYTES;
314*e7be843bSPierre Pronchery int ret = 0;
315*e7be843bSPierre Pronchery
316*e7be843bSPierre Pronchery /* Not ours to handle */
317*e7be843bSPierre Pronchery if ((codec = ml_kem_get_codec(v->evp_type)) == NULL)
318*e7be843bSPierre Pronchery return 0;
319*e7be843bSPierre Pronchery
320*e7be843bSPierre Pronchery if (!ossl_ml_kem_have_prvkey(key)) {
321*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_NOT_A_PRIVATE_KEY,
322*e7be843bSPierre Pronchery "no %s private key data available",
323*e7be843bSPierre Pronchery key->vinfo->algorithm_name);
324*e7be843bSPierre Pronchery return 0;
325*e7be843bSPierre Pronchery }
326*e7be843bSPierre Pronchery
327*e7be843bSPierre Pronchery formats = ossl_prov_ctx_get_param(
328*e7be843bSPierre Pronchery provctx, OSSL_PKEY_PARAM_ML_KEM_OUTPUT_FORMATS, NULL);
329*e7be843bSPierre Pronchery fmt_slots = ossl_ml_common_pkcs8_fmt_order(v->algorithm_name, codec->p8fmt,
330*e7be843bSPierre Pronchery "output", formats);
331*e7be843bSPierre Pronchery if (fmt_slots == NULL)
332*e7be843bSPierre Pronchery return 0;
333*e7be843bSPierre Pronchery
334*e7be843bSPierre Pronchery /* If we don't have a seed, skip seedful entries */
335*e7be843bSPierre Pronchery for (slot = fmt_slots; (p8fmt = slot->fmt) != NULL; ++slot)
336*e7be843bSPierre Pronchery if (ossl_ml_kem_have_seed(key) || p8fmt->seed_length == 0)
337*e7be843bSPierre Pronchery break;
338*e7be843bSPierre Pronchery /* No matching table entries, give up */
339*e7be843bSPierre Pronchery if (p8fmt == NULL
340*e7be843bSPierre Pronchery || (p8fmt->seed_length > 0 && p8fmt->seed_length != ML_KEM_SEED_BYTES)
341*e7be843bSPierre Pronchery || (p8fmt->priv_length > 0 && p8fmt->priv_length != v->prvkey_bytes)
342*e7be843bSPierre Pronchery || (p8fmt->pub_length > 0 && p8fmt->pub_length != v->pubkey_bytes)) {
343*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_ML_KEM_NO_FORMAT,
344*e7be843bSPierre Pronchery "no matching enabled %s private key output formats",
345*e7be843bSPierre Pronchery v->algorithm_name);
346*e7be843bSPierre Pronchery goto end;
347*e7be843bSPierre Pronchery }
348*e7be843bSPierre Pronchery len = p8fmt->p8_bytes;
349*e7be843bSPierre Pronchery
350*e7be843bSPierre Pronchery if (out == NULL) {
351*e7be843bSPierre Pronchery ret = len;
352*e7be843bSPierre Pronchery goto end;
353*e7be843bSPierre Pronchery }
354*e7be843bSPierre Pronchery
355*e7be843bSPierre Pronchery if ((pos = buf = OPENSSL_malloc((size_t) len)) == NULL)
356*e7be843bSPierre Pronchery goto end;
357*e7be843bSPierre Pronchery
358*e7be843bSPierre Pronchery switch (p8fmt->p8_shift) {
359*e7be843bSPierre Pronchery case 0:
360*e7be843bSPierre Pronchery pos = OPENSSL_store_u32_be(pos, p8fmt->p8_magic);
361*e7be843bSPierre Pronchery break;
362*e7be843bSPierre Pronchery case 2:
363*e7be843bSPierre Pronchery pos = OPENSSL_store_u16_be(pos, (uint16_t)p8fmt->p8_magic);
364*e7be843bSPierre Pronchery break;
365*e7be843bSPierre Pronchery case 4:
366*e7be843bSPierre Pronchery break;
367*e7be843bSPierre Pronchery default:
368*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
369*e7be843bSPierre Pronchery "error encoding %s private key",
370*e7be843bSPierre Pronchery v->algorithm_name);
371*e7be843bSPierre Pronchery goto end;
372*e7be843bSPierre Pronchery }
373*e7be843bSPierre Pronchery
374*e7be843bSPierre Pronchery if (p8fmt->seed_length != 0) {
375*e7be843bSPierre Pronchery /*
376*e7be843bSPierre Pronchery * Either the tag/len were already included in |magic| or they require
377*e7be843bSPierre Pronchery * us to write two bytes now.
378*e7be843bSPierre Pronchery */
379*e7be843bSPierre Pronchery if (pos + sizeof(uint16_t) == buf + p8fmt->seed_offset)
380*e7be843bSPierre Pronchery pos = OPENSSL_store_u16_be(pos, p8fmt->seed_magic);
381*e7be843bSPierre Pronchery if (pos != buf + p8fmt->seed_offset
382*e7be843bSPierre Pronchery || !ossl_ml_kem_encode_seed(pos, ML_KEM_SEED_BYTES, key)) {
383*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
384*e7be843bSPierre Pronchery "error encoding %s private key",
385*e7be843bSPierre Pronchery v->algorithm_name);
386*e7be843bSPierre Pronchery goto end;
387*e7be843bSPierre Pronchery }
388*e7be843bSPierre Pronchery pos += ML_KEM_SEED_BYTES;
389*e7be843bSPierre Pronchery }
390*e7be843bSPierre Pronchery if (p8fmt->priv_length != 0) {
391*e7be843bSPierre Pronchery if (pos + sizeof(uint32_t) == buf + p8fmt->priv_offset)
392*e7be843bSPierre Pronchery pos = OPENSSL_store_u32_be(pos, p8fmt->priv_magic);
393*e7be843bSPierre Pronchery if (pos != buf + p8fmt->priv_offset
394*e7be843bSPierre Pronchery || !ossl_ml_kem_encode_private_key(pos, v->prvkey_bytes, key)) {
395*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
396*e7be843bSPierre Pronchery "error encoding %s private key",
397*e7be843bSPierre Pronchery v->algorithm_name);
398*e7be843bSPierre Pronchery goto end;
399*e7be843bSPierre Pronchery }
400*e7be843bSPierre Pronchery pos += v->prvkey_bytes;
401*e7be843bSPierre Pronchery }
402*e7be843bSPierre Pronchery /* OQS form output with tacked-on public key */
403*e7be843bSPierre Pronchery if (p8fmt->pub_length != 0) {
404*e7be843bSPierre Pronchery /* The OQS pubkey is never separately DER-wrapped */
405*e7be843bSPierre Pronchery if (pos != buf + p8fmt->pub_offset
406*e7be843bSPierre Pronchery || !ossl_ml_kem_encode_public_key(pos, v->pubkey_bytes, key)) {
407*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
408*e7be843bSPierre Pronchery "error encoding %s private key",
409*e7be843bSPierre Pronchery v->algorithm_name);
410*e7be843bSPierre Pronchery goto end;
411*e7be843bSPierre Pronchery }
412*e7be843bSPierre Pronchery pos += v->pubkey_bytes;
413*e7be843bSPierre Pronchery }
414*e7be843bSPierre Pronchery
415*e7be843bSPierre Pronchery if (pos == buf + len) {
416*e7be843bSPierre Pronchery *out = buf;
417*e7be843bSPierre Pronchery ret = len;
418*e7be843bSPierre Pronchery }
419*e7be843bSPierre Pronchery
420*e7be843bSPierre Pronchery end:
421*e7be843bSPierre Pronchery OPENSSL_free(fmt_slots);
422*e7be843bSPierre Pronchery if (ret == 0)
423*e7be843bSPierre Pronchery OPENSSL_free(buf);
424*e7be843bSPierre Pronchery return ret;
425*e7be843bSPierre Pronchery }
426*e7be843bSPierre Pronchery
ossl_ml_kem_key_to_text(BIO * out,const ML_KEM_KEY * key,int selection)427*e7be843bSPierre Pronchery int ossl_ml_kem_key_to_text(BIO *out, const ML_KEM_KEY *key, int selection)
428*e7be843bSPierre Pronchery {
429*e7be843bSPierre Pronchery uint8_t seed[ML_KEM_SEED_BYTES], *prvenc = NULL, *pubenc = NULL;
430*e7be843bSPierre Pronchery size_t publen, prvlen;
431*e7be843bSPierre Pronchery const char *type_label = NULL;
432*e7be843bSPierre Pronchery int ret = 0;
433*e7be843bSPierre Pronchery
434*e7be843bSPierre Pronchery if (out == NULL || key == NULL) {
435*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
436*e7be843bSPierre Pronchery return 0;
437*e7be843bSPierre Pronchery }
438*e7be843bSPierre Pronchery type_label = key->vinfo->algorithm_name;
439*e7be843bSPierre Pronchery publen = key->vinfo->pubkey_bytes;
440*e7be843bSPierre Pronchery prvlen = key->vinfo->prvkey_bytes;
441*e7be843bSPierre Pronchery
442*e7be843bSPierre Pronchery if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0
443*e7be843bSPierre Pronchery && (ossl_ml_kem_have_prvkey(key)
444*e7be843bSPierre Pronchery || ossl_ml_kem_have_seed(key))) {
445*e7be843bSPierre Pronchery if (BIO_printf(out, "%s Private-Key:\n", type_label) <= 0)
446*e7be843bSPierre Pronchery return 0;
447*e7be843bSPierre Pronchery
448*e7be843bSPierre Pronchery if (ossl_ml_kem_have_seed(key)) {
449*e7be843bSPierre Pronchery if (!ossl_ml_kem_encode_seed(seed, sizeof(seed), key))
450*e7be843bSPierre Pronchery goto end;
451*e7be843bSPierre Pronchery if (!ossl_bio_print_labeled_buf(out, "seed:", seed, sizeof(seed)))
452*e7be843bSPierre Pronchery goto end;
453*e7be843bSPierre Pronchery }
454*e7be843bSPierre Pronchery if (ossl_ml_kem_have_prvkey(key)) {
455*e7be843bSPierre Pronchery if ((prvenc = OPENSSL_malloc(prvlen)) == NULL)
456*e7be843bSPierre Pronchery return 0;
457*e7be843bSPierre Pronchery if (!ossl_ml_kem_encode_private_key(prvenc, prvlen, key))
458*e7be843bSPierre Pronchery goto end;
459*e7be843bSPierre Pronchery if (!ossl_bio_print_labeled_buf(out, "dk:", prvenc, prvlen))
460*e7be843bSPierre Pronchery goto end;
461*e7be843bSPierre Pronchery }
462*e7be843bSPierre Pronchery ret = 1;
463*e7be843bSPierre Pronchery }
464*e7be843bSPierre Pronchery
465*e7be843bSPierre Pronchery /* The public key is output regardless of the selection */
466*e7be843bSPierre Pronchery if (ossl_ml_kem_have_pubkey(key)) {
467*e7be843bSPierre Pronchery /* If we did not output private key bits, this is a public key */
468*e7be843bSPierre Pronchery if (ret == 0 && BIO_printf(out, "%s Public-Key:\n", type_label) <= 0)
469*e7be843bSPierre Pronchery goto end;
470*e7be843bSPierre Pronchery
471*e7be843bSPierre Pronchery if ((pubenc = OPENSSL_malloc(key->vinfo->pubkey_bytes)) == NULL
472*e7be843bSPierre Pronchery || !ossl_ml_kem_encode_public_key(pubenc, publen, key)
473*e7be843bSPierre Pronchery || !ossl_bio_print_labeled_buf(out, "ek:", pubenc, publen))
474*e7be843bSPierre Pronchery goto end;
475*e7be843bSPierre Pronchery ret = 1;
476*e7be843bSPierre Pronchery }
477*e7be843bSPierre Pronchery
478*e7be843bSPierre Pronchery /* If we got here, and ret == 0, there was no key material */
479*e7be843bSPierre Pronchery if (ret == 0)
480*e7be843bSPierre Pronchery ERR_raise_data(ERR_LIB_PROV, PROV_R_MISSING_KEY,
481*e7be843bSPierre Pronchery "no %s key material available",
482*e7be843bSPierre Pronchery type_label);
483*e7be843bSPierre Pronchery
484*e7be843bSPierre Pronchery end:
485*e7be843bSPierre Pronchery OPENSSL_free(pubenc);
486*e7be843bSPierre Pronchery OPENSSL_free(prvenc);
487*e7be843bSPierre Pronchery return ret;
488*e7be843bSPierre Pronchery }
489