add sample PQC certificate + PKESK/SEIPD msg #65
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To be exact, that is Dilithium_round3-65+Ed25519 (an odd spec for Dilithium, I know) and Kyber_round3-768+X25519. |
Then I guess we discussed that the description of the test vector should point that out and include a reference to the specification document. That would really help people verify the given bits and bytes. i.e. add maybe something like "the test vector has been produced using the following algorithmic specifications [Dilithium_round3-65] and [Kyber_round3]". Such a sentence could be a moving target that develops into referencing the final standard for ML-DSA and ML-KEM in the end. |
|
@TJ-91 Very nice work. |
|
I added a general note in the Test vectors section and reference the spec again when writing e.g. "ML-DSA-65" to point to the Dilithium Round3 spec. Is further clarification needed? Edit: Should we also point to https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc#algorithm-names and give the name of the used spec according to that document?? |
|
Heyo, yesterday with @teythoon we managed to get the two implementations to partially interoperate, and spotted some bugs on both sides. These vectors here are unfortunately wrong:
Edit: he's gonna provide a partial patch for these issues |
|
FYI, here are some certs and messages we generated SK PK Message: Plaintext: Note that the PK does not sign the message. That's signed with a key that we didn't manage to export correctly (missing self-sig) |
|
I've implemented the latest spec here: ProtonMail/go-crypto#142 |
|
Thanks for testing and creating the certs+msg! With RNP I can use your keys fine. Decrypting the message fails as you already pointed out due to PKESK v3 incompatibilities. Please let me know when your partial fixes are available and whether I can help you with it. PS: Is there a specific reason why you generated PKESKv3/SEIPDv1 rather than the newer versions? I think we should generate two sets for the draft: v6 PQC keys + PKESKv6/SEIPDv2 and v4 PQC keys + PKESKv3/SEIPDv1 (but for now the main thing is to have any test vector that the implementations agree with at all) Edit:
Btw, this is due to a wrong initialization of a |
|
Hey :) I have some patches that you can use as a starting point. Unfortunately at the time we did the experiments, I didn't notice that you merged the work into RNP upstream, so I started with https://github.com/falko-strenzke/rnp branch v6_pqc_2306. Hope it will still be useful. |
|
I pushed my work here: https://github.com/teythoon/rnp/commits/justus/hackhack |
|
Thanks that's helpful! |
|
I also added the stock RNP with crypto-refresh enabled, using the stock Botan to our v6 test suite: https://tests.sequoia-pgp.org/v6.html |
|
Closing this since it's outdated. Thanks for the feedback everyone, this has been helpful and I hope to submit new test vectors soon. |
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I added a PQC certificate (public and private) and a v6 PKESK + v2 SEIPD message encrypted to that certificate. The two MUST algorithms are used, i.e., ML-DSA-65 + Ed25519 and ML-KEM-768 + X25519.
For the format and description and I oriented myself at the Crypto Refresh.
The RNP main branch at commit 6a15c33 has been used to produce the data.
To begin with, this test vector should be enough. Signatures are also covered since the key packets are signed. It would be good to parse and decrypt this with some other implementation as soon as one is available.
In the future we might want to add some in-depth dissection of interesting intermediate values as for example A.8. Sample X25519-AEAD-OCB encryption and decryption section of the Crypto Refresh.