EVP_PKEY refactoring for keygen/sign/verify; Start of ML-DSA impl #689
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #689 +/- ##
==========================================
- Coverage 95.80% 92.96% -2.84%
==========================================
Files 61 70 +9
Lines 8143 9508 +1365
Branches 0 9508 +9508
==========================================
+ Hits 7801 8839 +1038
- Misses 342 403 +61
- Partials 0 266 +266 ☔ View full report in Codecov by Sentry. |
| 1312 => Self::new(unsafe { | ||
| EVP_PKEY_pqdsa_new_raw_public_key(NID_MLDSA44, bytes.as_ptr(), bytes.len()) | ||
| }), | ||
| 1952 => Self::new(unsafe { | ||
| EVP_PKEY_pqdsa_new_raw_public_key(NID_MLDSA65, bytes.as_ptr(), bytes.len()) | ||
| }), | ||
| 2592 => Self::new(unsafe { | ||
| EVP_PKEY_pqdsa_new_raw_public_key(NID_MLDSA87, bytes.as_ptr(), bytes.len()) |
There was a problem hiding this comment.
Not for this PR, but should we consider exposing the Byte lengths for ML-DSA in AWS-LC? Seems like these are useful values for downstream consumers (like us) to depend on. Same for the private key lengths used above.
There was a problem hiding this comment.
Yeah, I could make that available from the API in the next PR. I have that information setup internally, I'll need to think about how to expose it.
| &self, | ||
| message: &[u8], | ||
| digest: Option<&'static digest::Algorithm>, | ||
| padding_fn: Option<F>, |
There was a problem hiding this comment.
Genuinely curious, is there a particular reason for the workaround and why we can't do Option<*mut EVP_PKEY_CTX>? Is it due to Option not being able to take mutable pointers?
There was a problem hiding this comment.
I would probably use an LcPtr for that approach. I'm sure it could be done that way, but I'd need to look at whether ownership also needs to transfer when passed.
| let key_private2 = | ||
| LcPtr::<EVP_PKEY>::parse_raw_private_key(&raw_private_buffer, EVP_PKEY_PQDSA).unwrap(); | ||
|
|
||
| // TODO: Currently the public key is not populated |
There was a problem hiding this comment.
Was this meant to say private? Is this an issue that the ML-DSA APIs still to iron out or support we're in the midst of adding
There was a problem hiding this comment.
At the time I wrote the code, only the private key was populated by AWS-LC. That's since been fixed.
Description of changes:
EVP_PKEY_keygenEVP_DigestSignandEVP_DigestVerify.Call-outs:
EVP_PKEY_keygen. When the "fips" feature is enabled, the FIPS-approved key generation mechanism will be used for all RSA keys.Testing:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.