PKCS#7: add ML-DSA (FIPS 204) SignedData support

Add ML-DSA signing and verification for CMS/PKCS#7 SignedData, following
RFC 9882. ML-DSA is used in CMS "pure" mode: the signature is computed
over the complete message (the DER SET OF signed attributes, or the
eContent when none are present) with an empty context string and absent
signatureAlgorithm parameters, rather than over a pre-computed DigestInfo
as with RSA/ECDSA.

wolfcrypt/src/pkcs7.c:
- New ML-DSA helpers: wc_PKCS7_MlDsaLevelFromOID, wc_PKCS7_BuildPureSigMessage,
  wc_PKCS7_MlDsaSign and wc_PKCS7_MlDsaVerify, wired into the per-algorithm
  switch sites (GetSignSize, SignedDataGetEncAlgoId, SetPublicKeyOID,
  CheckPublicKeyDer) and the sign/verify dispatchers. Only the final FIPS 204
  ML-DSA OIDs are accepted; pre-standard draft Dilithium OIDs are not.
- GetSignSize derives the ML-DSA signature length from the parameter set.
- InitWithCert copies the signer public key into the RSA-sized publicKey buffer
  only for RSA/ECC certs (the raw-sign callback consumers); large PQC keys such
  as ML-DSA would overflow it and are never read back, so publicKeySz stays 0.
- wc_MlDsaKey is always heap allocated (it embeds multi-KB key buffers); the
  accompanying DecodedCert uses the WC_DECLARE_VAR/WC_ALLOC_VAR_EX macros for
  stack-vs-heap handling under WOLFSSL_SMALL_STACK.
- wc_PKCS7_SignedDataBuildSignature skips building the DigestInfo for ML-DSA,
  which signs the full message in pure mode and never consumes it.
- wc_PKCS7_MlDsaSign wraps the ML-DSA private-key decode in
  PRIVATE_KEY_UNLOCK/PRIVATE_KEY_LOCK. Unlike RSA/ECC, the FIPS module gates
  wc_MlDsaKey_PrivateKeyDecode behind the private-key read lock, so signing
  would otherwise fail with FIPS_PRIVATE_KEY_LOCKED_E under --enable-fips. The
  macros are no-ops in non-FIPS builds.

wolfssl/wolfcrypt/pkcs7.h:
- Document that the fixed-size signer public key buffer (publicKey/publicKeySz)
  holds only RSA/ECC keys; it stays RSA-sized.

wolfcrypt/src/hash.c:
- Map the SHAKE128/SHAKE256 OIDs to their hash types in wc_OidGetHash().

certs/mldsa:
- Add expanded-only PKCS#8 DER private keys (mldsa44/65/87-key.der) matching
  the self-signed ML-DSA certificates, with README and include.am updates.
  The expanded-only shape (no seed) decodes via wc_MlDsaKey_ImportPrivRaw
  without keygen-from-seed or the ASN template, so pkcs7signed_mldsa_test also
  passes in WOLFSSL_MLDSA_NO_MAKE_KEY and non-WOLFSSL_ASN_TEMPLATE builds.

certs/renewcerts.sh:
- Generate the mldsa<N>-key.der files from the matching mldsa<N>-key.pem in the
  expanded-only shape (openssl pkey -provparam ml-dsa.output_formats=priv), so
  a regeneration keeps the DER key in step with the cert. The OpenSSL detection
  probe now requires both ML-DSA keygen and that conversion across all three
  levels, so the block runs fully (matched cert+key) or is skipped entirely
  rather than aborting mid-way.

wolfcrypt/test/test.c:
- Add pkcs7signed_mldsa_test(): round-trip encode/verify of SignedData across
  ML-DSA-44/65/87, with and without signed attributes, including a check that
  the digest algorithm parameters are encoded as expected. The message-digest
  OID is selected from the enabled hash set (SHA-512, else SHA-256, else SHA-1)
  so the test builds when SHA-512 is disabled. A negative case confirms ML-DSA
  rejects a caller-supplied pre-computed content hash with BAD_FUNC_ARG.

Author: Frauschi

.github/workflows/pq-all.yml

@@ -233,7 +233,11 @@ jobs:
           {"name": "mldsa-no-asn1-fips204-draft-opensslextra", "minutes": 1.2,
            "configure": ["--enable-intelasm", "--enable-sp-asm",
             "--enable-dilithium=yes,draft", "--enable-opensslextra",
-            "CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]}
+            "CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]},
+          {"name": "pkcs7-mldsa-only", "minutes": 1.2,
+           "comment": "PKCS#7 SignedData with ML-DSA as the only signature algorithm (no RSA, no ECC); guards the ML-DSA-only PKCS7 build path",
+           "configure": ["--enable-cryptonly", "--enable-mldsa",
+            "--enable-pkcs7", "--disable-rsa", "--disable-ecc"]}
           ]
           EOF
           .github/scripts/parallel-make-check.py \

certs/mldsa/README.txt

@@ -9,6 +9,24 @@ File variants, per level N in {44, 65, 87}:
   mldsa<N>_oqskeypair.der   liboqs concatenated (priv || pub) format
   mldsa<N>_pub-spki.der     SubjectPublicKeyInfo wrapping the public key
 
+Self-signed certificates and their matching keys (used by the PKCS#7/CMS
+SignedData tests), per level N in {44, 65, 87}:
+  mldsa<N>-cert.pem / mldsa<N>-cert.der   self-signed ML-DSA certificate
+  mldsa<N>-key.pem                        matching private key (PEM,
+                                          seed-and-expanded PKCS#8)
+  mldsa<N>-key.der                        matching private key (DER,
+                                          expanded-only PKCS#8)
+
+The mldsa<N>-key.der files were derived from the matching mldsa<N>-key.pem
+using OpenSSL 3.5+, selecting the portable expanded-only private-key shape:
+
+  openssl pkey -in mldsa<N>-key.pem \
+      -provparam ml-dsa.output_formats=priv -outform DER \
+      -out mldsa<N>-key.der
+
+Unlike the standalone mldsa<N>_priv-only.der vectors above, these correspond
+to the public key in mldsa<N>-cert.der.
+
 The *_pub-spki.der files were derived from the matching *_priv-only.der files
 using OpenSSL 3.5+:
 

certs/mldsa/include.am

@@ -26,13 +26,16 @@ EXTRA_DIST += \
 		 certs/mldsa/mldsa87_bare-seed.der \
 		 certs/mldsa/mldsa87_bare-priv.der \
 		 certs/mldsa/mldsa44-key.pem \
+		 certs/mldsa/mldsa44-key.der \
 		 certs/mldsa/mldsa44-cert.pem \
 		 certs/mldsa/mldsa44-cert.der \
 		 certs/mldsa/ecc-leaf-mldsa44.pem \
 		 certs/mldsa/mldsa65-key.pem \
+		 certs/mldsa/mldsa65-key.der \
 		 certs/mldsa/mldsa65-cert.pem \
 		 certs/mldsa/mldsa65-cert.der \
 		 certs/mldsa/mldsa87-key.pem \
+		 certs/mldsa/mldsa87-key.der \
 		 certs/mldsa/mldsa87-cert.pem \
 		 certs/mldsa/mldsa87-cert.der \
 		 certs/mldsa/bench_mldsa_44_key.der \

certs/mldsa/mldsa44-key.der

@@ -1187,13 +1187,19 @@ EOF
     ############################################################
     #### ML-DSA (FIPS 204) self-signed certificates          ###
     ############################################################
-    # ML-DSA requires an OpenSSL 3.x binary with ML-DSA support
-    # (via oqsprovider or built-in). Detect support by probing candidates.
+    # ML-DSA requires an OpenSSL 3.5+ binary with the built-in ML-DSA provider.
+    # Besides key/cert generation the block also produces the expanded-only
+    # PKCS#8 key.der (-provparam ml-dsa.output_formats=priv, a 3.5+ built-in
+    # construct) that the PKCS#7 tests decode without keygen-from-seed. The
+    # probe below requires both keygen and that conversion, so the common
+    # unsuitable binaries (oqsprovider or pre-3.5, which lack the expanded-only
+    # conversion) are rejected here and the block is skipped cleanly rather
+    # than aborting after writing a cert.der but no matching key.der.
     OPENSSL3=""
     for candidate in \
-        "/usr/local/opt/openssl@3.2/bin/openssl" \
+        "/usr/local/opt/openssl@3.5/bin/openssl" \
         "/usr/local/opt/openssl@3/bin/openssl" \
-        "/opt/homebrew/opt/openssl@3.2/bin/openssl" \
+        "/opt/homebrew/opt/openssl@3.5/bin/openssl" \
         "/opt/homebrew/opt/openssl@3/bin/openssl" \
         "openssl"; do
         if [ "$candidate" = "openssl" ]; then
@@ -1203,7 +1209,23 @@ EOF
             # Skip non-existent or non-executable absolute paths.
             [ -x "$candidate" ] || continue
         fi
-        if "$candidate" genpkey -algorithm mldsa44 -out /dev/null 2>/dev/null; then
+        probe_key="$(mktemp)" || continue
+        # Probe every level the loop below generates (44/65/87), for both
+        # keygen and the expanded-only conversion, so a partially-capable
+        # binary is rejected up front rather than aborting mid-loop.
+        probe_ok=1
+        for probe_level in 44 65 87; do
+            if ! "$candidate" genpkey -algorithm "mldsa${probe_level}" \
+                    -out "$probe_key" 2>/dev/null || \
+               ! "$candidate" pkey -in "$probe_key" \
+                    -provparam ml-dsa.output_formats=priv -outform DER \
+                    -out /dev/null 2>/dev/null; then
+                probe_ok=0
+                break
+            fi
+        done
+        rm -f "$probe_key"
+        if [ "$probe_ok" -eq 1 ]; then
             OPENSSL3="$candidate"
             break
         fi
@@ -1230,6 +1252,19 @@ EOF
                 -outform DER -out "mldsa/mldsa${level}-cert.der"
             check_result $? "ML-DSA-${level} DER conversion"
 
+            # Matching private key in the portable expanded-only PKCS#8 DER
+            # shape, used by the PKCS#7/CMS SignedData tests. Derived from the
+            # same mldsa${level}-key.pem so it corresponds to the public key in
+            # mldsa${level}-cert.der. The expanded-only form (no seed) decodes
+            # via ImportPrivRaw without keygen-from-seed or the ASN template,
+            # so the tests pass in WOLFSSL_MLDSA_NO_MAKE_KEY and non-template
+            # builds too; the seed-and-expanded default would not. The probe
+            # above already verified this binary supports the conversion.
+            "$OPENSSL3" pkey -in "mldsa/mldsa${level}-key.pem" \
+                -provparam ml-dsa.output_formats=priv -outform DER \
+                -out "mldsa/mldsa${level}-key.der"
+            check_result $? "ML-DSA-${level} key DER conversion"
+
             echo "End of ML-DSA-${level} section"
         done
 
@@ -1254,7 +1289,7 @@ EOF
         echo "End of ecc-leaf-mldsa44 section"
         echo "---------------------------------------------------------------------"
     else
-        echo "Skipping ML-DSA cert generation (no OpenSSL 3.3+ with ML-DSA support found)"
+        echo "Skipping ML-DSA cert generation (no OpenSSL 3.5+ built-in ML-DSA provider found)"
         echo "---------------------------------------------------------------------"
     fi
 

certs/mldsa/mldsa65-key.der

@@ -11802,8 +11802,9 @@ AS_IF([test "x$ENABLED_INTEL_QA_SYNC" = "xyes" || test "x$ENABLED_OCTEON_SYNC" =
 # checks for pkcs7 needed enables
 AS_IF([test "x$ENABLED_PKCS7" = "xyes" && \
        test "x$ENABLED_RSA" = "xno" && \
-       test "x$ENABLED_ECC" = "xno"],
-      [AC_MSG_ERROR([please enable ecc or rsa if enabling pkcs7.])])
+       test "x$ENABLED_ECC" = "xno" && \
+       test "x$ENABLED_MLDSA" = "xno"],
+      [AC_MSG_ERROR([please enable ecc, rsa or mldsa if enabling pkcs7.])])
 
 AS_IF([test "x$ENABLED_PKCS7" = "xyes" && \
        test "x$ENABLED_SHA" = "xno" && \

certs/mldsa/mldsa87-key.der

@@ -353,6 +353,20 @@ enum wc_HashType wc_OidGetHash(int oid)
             hash_type = WC_ERR_TRACE(WC_HASH_TYPE_NONE);
         #endif
             break;
+        case SHAKE128h:
+        #if defined(WOLFSSL_SHA3) && defined(WOLFSSL_SHAKE128)
+            hash_type = WC_HASH_TYPE_SHAKE128;
+        #else
+            hash_type = WC_ERR_TRACE(WC_HASH_TYPE_NONE);
+        #endif
+            break;
+        case SHAKE256h:
+        #if defined(WOLFSSL_SHA3) && defined(WOLFSSL_SHAKE256)
+            hash_type = WC_HASH_TYPE_SHAKE256;
+        #else
+            hash_type = WC_ERR_TRACE(WC_HASH_TYPE_NONE);
+        #endif
+            break;
         case SM3h:
         #ifdef WOLFSSL_SM3
             hash_type = WC_HASH_TYPE_SM3;