openssl / openssl/openssl

ML-KEM digest fetching

Open
#27,743 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

branch: 3.5 branch: master triaged: bug
Dominant language
C
Stars
30.8k
Forks
11.5k
Avg merge
10m
Merged PRs (30d)
1

Description

I came across that fetching parameters are ignored when creating ML-KEM public key from data. I want to fetch supplementary digests with particular properties.

EVP_KEYMGMT object for ML-KEM supports OSSL_PKEY_PARAM_PROPERTIES only for key generation, not for fetching.

EVP_PKEY_fromdata calls evp_keymgmt_util_fromdata implemented as

https://github.com/openssl/openssl/blob/f426dd1311eecd12f24190c94f56eb85e62aaa27/crypto/evp/keymgmt_lib.c#L319-L331

Fetching of supplementary digests (SHAKE, SHA3) happens when we call evp_keymgmt_newdata (ossl_ml_kem_key_new callback) and parameters are processed only in evp_keymgmt_import.

Can we improve this situation?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with crypto/evp/keymgmt_lib.c at the referenced evp_keymgmt_util_fromdata code, then trace ossl_ml_kem_key_new and evp_keymgmt_import in the ML-KEM key-management implementation. Reproduce EVP_PKEY_fromdata with OSSL_PKEY_PARAM_PROPERTIES and inspect how supplementary SHAKE and SHA3 digests are fetched. Done means the requested properties are honored when creating an ML-KEM public key and the behavior is covered by validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.