Feature: SLH-DSA signatures in CMS/PKCS#7 (RFC 9814). Willing to contribute

[ducanhmit]

Description

wolfSSL supports SLH-DSA (FIPS 205) in wolfCrypt and TLS 1.3, and ML-DSA in PKCS#7 SignedData, but wc_PKCS7_EncodeSignedData() / wc_PKCS7_VerifySignedData() don't support SLH-DSA signer keys yet.

RFC 9814 (July 2025) specifies SLH-DSA in CMS. It's useful for long-lived signatures such as firmware, document and code signing, where a conservative hash-based scheme is preferred. OpenSSL 3.5 supports it.

Proposed implementation

I'd like to implement this and submit a PR, following the existing ML-DSA support in pkcs7.c:

• Accept SLH-DSA signer certificates/keys (all 12 SHA2 and SHAKE parameter sets) in SignedData encode and verify.
• signatureAlgorithm uses the id-slh-dsa-* OIDs with parameters absent, as RFC 9814 §4 requires.
• Sign the DER-encoded signed attributes directly with pure SLH-DSA (no pre-hash); without signed attributes, sign the content itself.
• Default digestAlgorithm per RFC 9814: SHA-256 for SHA2-128, SHA-512 for SHA2-192/256, SHAKE128 for SHAKE-128, SHAKE256 for SHAKE-192/256. This reuses the existing RFC 8702 SHAKE digest handling.
• On verify, check that the signatureAlgorithm matches the signer's public key parameter set.
• Tests: sign/verify round trips for each parameter set (with and without signed attributes), a mismatched-parameter rejection, and interop vectors generated with OpenSSL 3.5 cms -sign.

Questions

1. Is this something you'd accept, and is anyone already working on it?
2. Is following the ML-DSA approach in pkcs7.c the preferred design, or would you rather see a shared helper for the PQC signature types?

I understand a contributor agreement is required and am happy to complete it.

[embhorn]

Hello @ducanhmit

Thanks for contacting wolfSSL Support. I have requested a review of this issue by our PQC expert who can elaborate on current plans for RFC 9814.

Kind regards,
@embhorn

[anhu]

Hi @ducanhmit ,

Let me ask my team if anyone has started work on such a feature. Please stay tuned.

Generally speaking, yes, such a contribution would be accepted with enthusiasm. Following the ML-DSA approach would be the most appropriate way to do it.

Warm regards, Anthony

[ducanhmit]

Thanks @embhorn and @anhu, that's great to hear.

I'll hold off on starting until you've confirmed nobody on the team is already working on it, and I'll follow the existing ML-DSA approach in pkcs7.c as you suggest.