X.509 certificates with PQC algorithms

[Stephan Mueller]

Hi,

knowing that the X.509 specifications with PQC algorithms is still in flux I
added support for X.509 generation and parsing to [1]. The intend is to
support overcoming the chicken-and-egg problem.

The description in [2] shows how X.509 certificates can now be generated using
PQC algorithm which can be parsed using the same code base. The generator and
parser are both available with command line as outlined in [2] as well as via
APIs [3] and [4].

The current support covers ML-DSA 44/65/87 only and applies HashML-DSA
following the current specification of RFC5280 stipulating the hash generation
as well as the draft RFCs that hint to that as well. The algorithm mapping
matrix is given in [5] and [6].

The addition of SLH-DSA and hybrid ML-DSA should come in the next days, where
hybrid ML-DSA attempts to follow [7].

PKCS#7 is also in the works.

Note, by using a human-readable format to define the ASN.1 structure,
adjustments to updates of data formats that may come with newer draft RFCs
should be fast to employ. See [8] for details.

A sample certificate chain consisting of a 4-way chain from a CA to a leaf are
given in [9].


[1] https://leancrypto.org/leancrypto

[2] https://github.com/smuellerDD/leancrypto/tree/master/asn1/src#x509-certificate-generator

[3] https://github.com/smuellerDD/leancrypto/blob/master/asn1/api/
lc_x509_parser.h

[4] https://github.com/smuellerDD/leancrypto/blob/master/asn1/api/
lc_x509_generator.h

[5] https://github.com/smuellerDD/leancrypto/blob/master/asn1/api/
lc_x509_generator.h

[6] https://github.com/smuellerDD/leancrypto/blob/master/asn1/src/
x509_algorithm_mapper.c#L195

[7] https://www.ietf.org/archive/id/draft-ietf-lamps-pq-composite-sigs-02.html

[8] https://github.com/smuellerDD/leancrypto/blob/master/asn1/src/
README.md#re-generate-c-code-from-asn1-files

[9] https://github.com/smuellerDD/leancrypto/tree/master/asn1/tests/testcerts

Ciao
Stephan

[Alex Railean]

Hi Stephan,

Thank you for sharing your materials. I believe it would be a good idea to consider joining the hackathons organized during IETF meets, there is a group focused on X509 certificate interoperability in the context of post quantum: https://github.com/IETF-Hackathon/pqc-certificates.

The repository has an automated mechanism that visualizes the result of what happens when you try to parse a certificate produced by tool X with tool Y. Besides that, you have direct contact with the people who write the software in question, so discrepancies can be addressed efficiently.

Alex

[Stephan Mueller]

Am Montag, 11. November 2024, 08:43:16 Mitteleuropäische Normalzeit schrieb
Alex Railean:

Hi Alex,

Thank you, I will try to participate there.


Ciao
Stephan