google / google/go-tpm

Add support for MLDSA and MLKEM

Open
#439 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
673
Forks
188
PR merge metrics
No merged PRs in 30d

Description

`MLDSA/MLKEM` support for TPM is defined in `rev.185`

* [tpm-library-specifications](https://trustedcomputinggroup.org/resource/tpm-library-specification/)

Support in go-tpm isn't there yet but it looks like its just needs the specific command and structure implementation:

* https://github.com/salrashid123/pqc_scratchpad/tree/main/tpm

@chrisfenner @josephlr I can submit a PR for the requsite structures which'll allow mldsa signatures as well as mlkem encapsulation if we're ready to pull the trigger on this.

One of the issues i see is that the simulator currently used in test cases in the repo used doens't support these algorithms and is dependent on upstream mssim to get there first. (the simulator uses the one from [go-tpm-tools](https://github.com/google/go-tpm-tools/tree/main/simulator)

also note that standard go currently supports `crypto/mlkem` and in a couple of weeks with `go1.27`, it'll support `crypto/mldsa`

Contributor guide

Open the contributing guide

Research direction

Start with the TPM library specification revision 185 and compare the required structures and commands with the examples in the linked pqc_scratchpad TPM directory. Check the go-tpm-tools simulator and its upstream mssim dependency to determine what test coverage is possible. Done means MLDSA signatures and MLKEM encapsulation are represented in go-tpm, with simulator limitations accounted for.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.