-
Notifications
You must be signed in to change notification settings - Fork 5.2k
Fix Composite ML-DSA OIDs #118795
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Composite ML-DSA OIDs #118795
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR fixes the OID (Object Identifier) values for Composite ML-DSA (Machine Learning Digital Signature Algorithm) constants to match the official specification in the IETF draft for post-quantum composite signatures.
- Updates all ML-DSA composite signature OIDs to include an additional ".1" segment in their identifiers
- Corrects 18 different ML-DSA variant OIDs to align with the standardized format
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch @BrennanConroy and @MackinnonBuck! These aren't being tested currently since PKCS8 and SPKI support hasn't been fully implemented yet.
|
/ba-g known failure (#118770, already fixed) |
|
@PranavSenthilnathan @bartonjs it looks like this missed the 10.0 snap. If we want this in 10 it needs to be back ported. |
This recently got pulled in with #118812, so not needed anymore. |
Fixes the OIDs for Composite ML-DSA to match what's described in https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-sigs/
Originally spotted by @BrennanConroy in dotnet/aspnetcore#63280