Support deterministic pure ML-DSA-87 in the PSA API #902

New issue

Open

opened 2026-09-07 12:16:51 -05:00 by gilles-peskine-arm · 0 comments

gilles-peskine-arm commented

2026-09-07 12:16:51 -05:00

(Migrated from github.com)

Prerequisite: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/900

Move the definition of PSA_ALG_DETERMINISTIC_ML_DSA to include/psa/crypto_values.h.
Declare PSA_WANTALG_DETERMINISTIC_ML_DSA in include/psa/crypto_config.h, default off. It will automatically be enabled in the full config.
- Use this macro to guard code that handles deterministic ML-DSA sign/verify generically.
- Code that is specifically for ML-DSA-87 must be also guarded by PSA_WANT_KEY_TYPE_ML_DSA_87.
When the corresponding algorithm is enabled, take MLDSA into account in PSA_SIGN_xxx_SIZE macros in include/psa/crypto_sizes.h. Move and rename auxiliary macros from drivers/pqcp/**.h where useful.
Support deterministic ML-DSA in psa_sign_hash, psa_sign_message, psa_verify_hash and psa_verify_message. Call driver dispatch.

All functions and macros must have unit tests in test_suite_psa_crypto.mldsa.data (create a new data file because the test data is big and we're trying to split up test_suite_psa_crypto.data). This should require only new test data, not new test code. We want both positive and negative tests (bad key size, not supported, buffer too small, etc. as applicable). There is no need to duplicate tests that are automatically generated.

In comments, document that the support for ML-DSA is still experimental. Remove explicit statements that ML-DSA support is incomplete (we now support a useful subset, even if we don't have all the sizes and all the algorithms yet). No changelog entry.

Prerequisite: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/900 * Move the definition of `PSA_ALG_DETERMINISTIC_ML_DSA` to `include/psa/crypto_values.h`. * Declare `PSA_WANTALG_DETERMINISTIC_ML_DSA` in `include/psa/crypto_config.h`, default off. It will automatically be enabled in the `full` config. * Use this macro to guard code that handles deterministic ML-DSA sign/verify generically. * Code that is specifically for ML-DSA-87 must be also guarded by `PSA_WANT_KEY_TYPE_ML_DSA_87`. * When the corresponding algorithm is enabled, take MLDSA into account in `PSA_SIGN_xxx_SIZE` macros in `include/psa/crypto_sizes.h`. Move and rename auxiliary macros from `drivers/pqcp/**.h` where useful. * Support deterministic ML-DSA in `psa_sign_hash`, `psa_sign_message`, `psa_verify_hash` and `psa_verify_message`. Call driver dispatch. All functions and macros must have unit tests in `test_suite_psa_crypto.mldsa.data` (create a new data file because the test data is big and we're trying to split up `test_suite_psa_crypto.data`). This should require only new test data, not new test code. We want both positive and negative tests (bad key size, not supported, buffer too small, etc. as applicable). There is no need to duplicate tests that are automatically generated. In comments, document that the support for ML-DSA is still experimental. Remove explicit statements that ML-DSA support is incomplete (we now support a useful subset, even if we don't have all the sizes and all the algorithms yet). No changelog entry.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#902

No description provided.

Rows
Columns