Skip to content

Adds support for post-quantum ML-DSA & ML-KEM algorithms #675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: 1.7-dev
Choose a base branch
from

Conversation

prabhu
Copy link
Contributor

@prabhu prabhu commented Aug 16, 2025

Fixes #674

With inspiration from the Node.js PRs and this, this pull request adds three new post-quantum algorithms: "ML-DSA-44", "ML-DSA-65", and "ML-DSA-87" and three new key encapsulation mechanisms: "ML-KEM-512", "ML-KEM-768", "ML-KEM-1024" to better future-proof BOM signature validity. The hypothetical but real threat this addresses is that traditional signatures with RSA/ECDSA may become invalid when quantum computers break them.

Following alternative ideas could be considered:

  1. URI-Based references

"algorithm": "urn:nist.gov:fips204:ml-dsa-44" instead of simple upper case enum strings. This however is a significant breaking change to replace all existing identifiers in use.

  1. Extend signer definition

Signature object support signer as one of the types. A new type called postQuantumSigner could be created to extend signer to capture additional attributes related to PQ algorithms and also to support a broad range of PQ algorithms.

"properties": {
            "signers": {
              "type": "array",
              "title": "Signature",
              "description": "Unique top level property for Multiple Signatures. (multisignature)",
              "items": {"$ref": "#/definitions/signer"}
            }
          }
  1. Enable additional properties

Currently, additional properties are disabled for signer. To increase flexibility, this could be enabled.

This PR proposes a simple enhancement to the enum, key type indicators, and validation, making this feature >= 1.7 only without any possibility for backports.

TBD:

Enhancing CBOM to support the corresponding OID values.

Algorithm OID
ml-dsa-44 2.16.840.1.101.3.4.3.17
ml-dsa-65 2.16.840.1.101.3.4.3.18
ml-dsa-87 2.16.840.1.101.3.4.3.19
ml-kem-512 2.16.840.1.101.3.4.4.1
ml-kem-768 2.16.840.1.101.3.4.4.2
ml-kem-1024 2.16.840.1.101.3.4.4.3

@prabhu prabhu requested a review from a team as a code owner August 16, 2025 12:39
@prabhu prabhu changed the title Adds support for post-quantum ML-DSA algorithms Adds support for post-quantum ML-DSA & ML-KEM algorithms Aug 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant