Pq mls ciphersuites#110
Draft
emil-wire wants to merge 15 commits into
Draft
Conversation
First release with the draft-ietf-hpke-pq KEMs we need: X-Wing, ML-KEM-768 with P-256, ML-KEM-1024 with P-384, and standalone ML-KEM variants. Also moves HPKE onto the provider RNG.
Covers ML-DSA-44, 65, and 87. Pinned to 0.1.1+ for the fix to GHSA-5x2r-hc65-25f9
Adds KEM identifiers from draft-ietf-hpke-pq and ML-DSA signature schemes from draft-ietf-tls-mldsa-01 with their signing paths. Cipher suites follow in separate commits.
Codepoint 0x647a from draft-ietf-hpke-pq. The hybrid combiner keeps X25519 standing if ML-KEM-768 breaks, and its SHA-3 and SHAKE internals live in the hpke crate.
Codepoint 0x0050 from draft-ietf-hpke-pq, a hybrid of ML-KEM-768 and NIST P-256.
Codepoint 0x0051 from draft-ietf-hpke-pq.
… KEMs Codepoints 0x0041 and 0x0042 from draft-ietf-hpke-pq, pure ML-KEM parameter sets without hybrid.
Pure FIPS-204 with an empty context, which is what MLS signs. Public keys are 1312, 1952 and 2592 bytes and signatures 2420, 3309 and 4627. The three parameter sets share one generic path.
Keypair generation and raw-bytes round tripping for the three ML-DSA parameter sets, with the seed zeroized after key derivation.
Adds draft-ietf-mls-pq-ciphersuites-06 suites TBD1-TBD5, TBD7-TBD8, TBD10-TBD11 with placeholder codepoints 0xF001-0xF009 since IANA hasn't assigned these yet. Each uses HKDF-SHA256 or HKDF-SHA384 to match the suite hash. They go into both the provider supported list and default leaf capabilities simultaneously - a suite in only one causes InsufficientCapabilities on group creation.
ML-KEM-768 with Ed25519, TBD6 in draft-ietf-mls-pq-ciphersuites-06 on placeholder codepoint 0xF00A. Appending rather than renumbering keeps 0xF001 to 0xF009 meaning what they already mean, so codepoint order no longer follows the draft TBD order. Reuses an existing HPKE KEM configuration.
Needed for the ML-DSA-44 suite, the first post-quantum suite without AES-GCM. The spec chose ChaCha20Poly1305 for acceptable pure-software performance.
X-Wing with ChaCha20Poly1305 and ML-DSA-44, TBD9 in draft-ietf-mls-pq-ciphersuites-06, on placeholder codepoint 0xF00B. The only suite here pairing post-quantum signatures with the 128-bit level.
Tests signature and HPKE round trips through our provider dispatch for every KEM, KDF, AEAD, and ML-DSA parameter set. Validates our wiring and algorithm mappings, not the underlying libraries.
Exercise group creation, add, commit, application messages, and remove across all eleven suites, including the ML-DSA-signed ones. These are round-trip tests rather than known-answer tests - no other implementation ships these suites yet, so they verify interoperability with themselves.
emil-wire
force-pushed
the
pq-mls-ciphersuites
branch
2 times, most recently
from
July 22, 2026 09:25
82c21de to
e2b60c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the nine post-quantum ciphersuites from draft-ietf-mls-pq-ciphersuites-06 (placeholder codepoints 0xF001-0xF009, IANA TBD).
What's here
Draft while the codepoints settle and the spec isn't finalized yet.