/src/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c

Source
/*
 * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/evp.h>
#include <openssl/param_build.h>
#include <openssl/proverr.h>
#include <openssl/self_test.h>
#include "crypto/ml_dsa.h"
#include "internal/fips.h"
#include "internal/param_build_set.h"
#include "prov/implementations.h"
#include "prov/providercommon.h"
#include "prov/provider_ctx.h"
#include "prov/ml_dsa.h"
#include "providers/implementations/keymgmt/keymgmtcommon.inc"

#define ml_dsa_export_params
#define ml_dsa_export_params_decoder
#include "providers/implementations/keymgmt/ml_dsa_kmgmt.inc"

static OSSL_FUNC_keymgmt_free_fn ml_dsa_free_key;
static OSSL_FUNC_keymgmt_has_fn ml_dsa_has;
static OSSL_FUNC_keymgmt_match_fn ml_dsa_match;
static OSSL_FUNC_keymgmt_import_fn ml_dsa_import;
static OSSL_FUNC_keymgmt_export_fn ml_dsa_export;
static OSSL_FUNC_keymgmt_import_types_fn ml_dsa_import_types;
static OSSL_FUNC_keymgmt_export_types_fn ml_dsa_export_types;
static OSSL_FUNC_keymgmt_dup_fn ml_dsa_dup_key;
static OSSL_FUNC_keymgmt_gettable_params_fn ml_dsa_gettable_params;
static OSSL_FUNC_keymgmt_validate_fn ml_dsa_validate;
static OSSL_FUNC_keymgmt_gen_init_fn ml_dsa_gen_init;
static OSSL_FUNC_keymgmt_gen_cleanup_fn ml_dsa_gen_cleanup;
static OSSL_FUNC_keymgmt_gen_set_params_fn ml_dsa_gen_set_params;
static OSSL_FUNC_keymgmt_gen_settable_params_fn ml_dsa_gen_settable_params;
#ifndef FIPS_MODULE
static OSSL_FUNC_keymgmt_load_fn ml_dsa_load;
#endif

struct ml_dsa_gen_ctx {
    PROV_CTX *provctx;
    char *propq;
    uint8_t entropy[32];
    size_t entropy_len;
};

#ifdef FIPS_MODULE
static int ml_dsa_pairwise_test(const ML_DSA_KEY *key)
{
    OSSL_SELF_TEST *st = NULL;
    OSSL_CALLBACK *cb = NULL;
    OSSL_LIB_CTX *ctx;
    void *cbarg = NULL;
    static const uint8_t msg[] = { 80, 108, 117, 103, 104 };
    uint8_t rnd[ML_DSA_ENTROPY_LEN];
    uint8_t sig[ML_DSA_87_SIG_LEN];
    size_t sig_len = 0;
    int ret = 0;

    if (!ml_dsa_has(key, OSSL_KEYMGMT_SELECT_KEYPAIR)
        || ossl_fips_self_testing()
        || ossl_self_test_in_progress(ST_ID_ASYM_KEYGEN_ML_DSA))
        return 1;

    /*
     * The functions `OSSL_SELF_TEST_*` will return directly if parameter `st`
     * is NULL.
     */
    ctx = ossl_ml_dsa_key_get0_libctx(key);
    OSSL_SELF_TEST_get_callback(ctx, &cb, &cbarg);

    if ((st = OSSL_SELF_TEST_new(cb, cbarg)) == NULL)
        return 0;

    OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT,
        OSSL_SELF_TEST_DESC_PCT_ML_DSA);

    memset(rnd, 0, sizeof(rnd));
    memset(sig, 0, sizeof(sig));

    if (ossl_ml_dsa_sign(key, 0, msg, sizeof(msg), NULL, 0, rnd, sizeof(rnd), 0,
            sig, &sig_len, sizeof(sig))
        <= 0)
        goto err;

    OSSL_SELF_TEST_oncorrupt_byte(st, sig);

    if (ossl_ml_dsa_verify(key, 0, msg, sizeof(msg), NULL, 0, 0,
            sig, sig_len)
        <= 0)
        goto err;

    ret = 1;
err:
    OSSL_SELF_TEST_onend(st, ret);
    OSSL_SELF_TEST_free(st);
    OPENSSL_cleanse(sig, sizeof(sig));
    return ret;
}
#endif

ML_DSA_KEY *ossl_prov_ml_dsa_new(PROV_CTX *ctx, const char *propq, int evp_type)
{
    ML_DSA_KEY *key;

    if (!ossl_prov_is_running())
        return 0;

#ifdef FIPS_MODULE
    if (!ossl_deferred_self_test(PROV_LIBCTX_OF(ctx),
            ST_ID_ASYM_KEYGEN_ML_DSA))
        return NULL;
#endif

    key = ossl_ml_dsa_key_new(PROV_LIBCTX_OF(ctx), propq, evp_type);
    /*
     * When decoding, if the key ends up "loaded" into the same provider, these
     * are the correct config settings, otherwise, new values will be assigned
     * on import into a different provider.  The "load" API does not pass along
     * the provider context.
     */
    if (key != NULL) {
        int flags_set = 0, flags_clr = 0;

        if (ossl_prov_ctx_get_bool_param(
                ctx, OSSL_PKEY_PARAM_ML_DSA_RETAIN_SEED, 1))
            flags_set |= ML_DSA_KEY_RETAIN_SEED;
        else
            flags_clr = ML_DSA_KEY_RETAIN_SEED;

        if (ossl_prov_ctx_get_bool_param(
                ctx, OSSL_PKEY_PARAM_ML_DSA_PREFER_SEED, 1))
            flags_set |= ML_DSA_KEY_PREFER_SEED;
        else
            flags_clr |= ML_DSA_KEY_PREFER_SEED;

        ossl_ml_dsa_set_prekey(key, flags_set, flags_clr, NULL, 0, NULL, 0);
    }
    return key;
}

static ML_DSA_KEY *ossl_prov_ml_dsa_new_ex(PROV_CTX *ctx, const OSSL_PARAM params[], int evp_type)
{
    struct ml_dsa_new_key_ex_params_st p;
    const char *propq = NULL;

    if (!ml_dsa_new_key_ex_params_decoder(params, &p))
        return 0;

    if (p.propq != NULL) {
        if (p.propq->data_type != OSSL_PARAM_UTF8_STRING)
            return 0;
        propq = p.propq->data;
    }

    return ossl_prov_ml_dsa_new(ctx, propq, evp_type);
}

static void ml_dsa_free_key(void *keydata)
{
    ossl_ml_dsa_key_free((ML_DSA_KEY *)keydata);
}

static void *ml_dsa_dup_key(const void *keydata_from, int selection)
{
    if (ossl_prov_is_running())
        return ossl_ml_dsa_key_dup(keydata_from, selection);
    return NULL;
}

static int ml_dsa_has(const void *keydata, int selection)
{
    const ML_DSA_KEY *key = keydata;

    if (!ossl_prov_is_running() || key == NULL)
        return 0;
    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
        return 1; /* the selection is not missing */

    return ossl_ml_dsa_key_has(key, selection);
}

static int ml_dsa_match(const void *keydata1, const void *keydata2, int selection)
{
    const ML_DSA_KEY *key1 = keydata1;
    const ML_DSA_KEY *key2 = keydata2;

    if (!ossl_prov_is_running())
        return 0;
    if (key1 == NULL || key2 == NULL)
        return 0;
    return ossl_ml_dsa_key_equal(key1, key2, selection);
}

static int ml_dsa_validate(const void *key_data, int selection, int check_type)
{
    const ML_DSA_KEY *key = key_data;

    if (!ml_dsa_has(key, selection))
        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_KEYPAIR)
        return ossl_ml_dsa_key_pairwise_check(key);
    return 1;
}

/**
 * @brief Load a ML_DSA key from raw data.
 *
 * @param key An ML_DSA key to load into
 * @param params An array of parameters containing key data.
 * @param include_private Set to 1 to optionally include the private key data
 *                        if it exists.
 * @returns 1 on success, or 0 on failure.
 */
static int ml_dsa_key_fromdata(ML_DSA_KEY *key, const OSSL_PARAM params[],
    int include_private)
{
    const ML_DSA_PARAMS *key_params = ossl_ml_dsa_key_params(key);
    const uint8_t *pk = NULL, *sk = NULL, *seed = NULL;
    size_t pk_len = 0, sk_len = 0, seed_len = 0;
    struct ml_dsa_import_params_st p;

    if (!ml_dsa_import_params_decoder(params, &p))
        return 0;

    if (p.pubkey != NULL) {
        if (!OSSL_PARAM_get_octet_string_ptr(p.pubkey, (const void **)&pk, &pk_len))
            return 0;
        if (pk_len != 0 && pk_len != key_params->pk_len) {
            ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH,
                "Invalid %s public key length", key_params->alg);
            return 0;
        }
    }

    /* Private key seed is optional */
    if (p.seed != NULL && include_private) {
        if (!OSSL_PARAM_get_octet_string_ptr(p.seed, (const void **)&seed,
                &seed_len))
            return 0;
        if (seed_len != 0 && seed_len != ML_DSA_SEED_BYTES) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
            return 0;
        }
    }

    /* Private key is optional */
    if (p.privkey != NULL && include_private) {
        if (!OSSL_PARAM_get_octet_string_ptr(p.privkey, (const void **)&sk,
                &sk_len))
            return 0;
        if (sk_len != 0 && sk_len != key_params->sk_len) {
            ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH,
                "Invalid %s private key length",
                key_params->alg);
            return 0;
        }
    }

    /* The caller MUST specify at least one of seed, private or public keys. */
    if (seed_len == 0 && pk_len == 0 && sk_len == 0) {
        ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
        return 0;
    }

    if (p.propq != NULL) {
        if (p.propq->data_type != OSSL_PARAM_UTF8_STRING)
            return 0;
        if (!ossl_ml_dsa_key_fetch_digests(key, p.propq->data))
            return 0;
    }
    if (seed_len != 0
        && (sk_len == 0
            || (ossl_ml_dsa_key_get_prov_flags(key) & ML_DSA_KEY_PREFER_SEED))) {
        if (!ossl_ml_dsa_set_prekey(key, 0, 0, seed, seed_len, sk, sk_len))
            return 0;
        if (!ossl_ml_dsa_generate_key(key)) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GENERATE_KEY);
            return 0;
        }
    } else if (sk_len > 0) {
        if (!ossl_ml_dsa_sk_decode(key, sk, sk_len))
            return 0;
    } else if (pk_len > 0) {
        if (!ossl_ml_dsa_pk_decode(key, pk, pk_len))
            return 0;
    }

    /* Error if the supplied public key does not match the generated key */
    if (pk_len == 0
        || seed_len + sk_len == 0
        || memcmp(ossl_ml_dsa_key_get_pub(key), pk, pk_len) == 0)
        return 1;
    ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY,
        "explicit %s public key does not match private",
        key_params->alg);
    ossl_ml_dsa_key_reset(key);
    return 0;
}

static int ml_dsa_import(void *keydata, int selection, const OSSL_PARAM params[])
{
    ML_DSA_KEY *key = keydata;
    int include_priv;
    int res;

    /*
     * Once a key is fully initialised (has at least a public component),
     * further mutation is no longer safe and disallowed.
     */
    if (!ossl_prov_is_running() || key == NULL)
        return 0;
    if (ossl_ml_dsa_key_has(key, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)) {
        /* Invalid attempt to mutate a key. */
        ERR_raise_data(ERR_LIB_PROV, PROV_R_KEY_IMMUTABLE_ONCE_SET,
            "Keys are immutable once key material has been loaded or generated");
        return 0;
    }

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
        return 0;

    include_priv = ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0);
    res = ml_dsa_key_fromdata(key, params, include_priv);
#ifdef FIPS_MODULE
    if (res > 0) {
        res = ml_dsa_pairwise_test(key);
        if (!res)
            ossl_ml_dsa_key_reset(key);
    }
#endif /* FIPS_MODULE */
    return res;
}

static const OSSL_PARAM *ml_dsa_import_types(int selection)
{
    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
        return NULL;
    return ml_dsa_import_params_list;
}

static const OSSL_PARAM *ml_dsa_export_types(int selection)
{
    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
        return NULL;
    return ml_dsa_export_params_list;
}

static const OSSL_PARAM *ml_dsa_gettable_params(void *provctx)
{
    return ml_dsa_get_params_list;
}

static int ml_dsa_get_params(void *keydata, OSSL_PARAM params[])
{
    ML_DSA_KEY *key = keydata;
    const uint8_t *d;
    size_t len;
    struct ml_dsa_get_params_st p;

    if (key == NULL || !ml_dsa_get_params_decoder(params, &p))
        return 0;

    if (p.bits != NULL
        && !OSSL_PARAM_set_size_t(p.bits, 8 * ossl_ml_dsa_key_get_pub_len(key)))
        return 0;

    if (p.secbits != NULL
        && !OSSL_PARAM_set_size_t(p.secbits, ossl_ml_dsa_key_get_collision_strength_bits(key)))
        return 0;

    if (p.maxsize != NULL
        && !OSSL_PARAM_set_size_t(p.maxsize, ossl_ml_dsa_key_get_sig_len(key)))
        return 0;

    if (p.seccat != NULL
        && !OSSL_PARAM_set_int(p.seccat, ossl_ml_dsa_key_get_security_category(key)))
        return 0;

    if (p.seed != NULL) {
        d = ossl_ml_dsa_key_get_seed(key);
        if (d != NULL && !OSSL_PARAM_set_octet_string(p.seed, d, ML_DSA_SEED_BYTES))
            return 0;
    }

    if (p.privkey != NULL) {
        d = ossl_ml_dsa_key_get_priv(key);
        if (d != NULL) {
            len = ossl_ml_dsa_key_get_priv_len(key);
            if (!OSSL_PARAM_set_octet_string(p.privkey, d, len))
                return 0;
        }
    }

    if (p.pubkey != NULL) {
        d = ossl_ml_dsa_key_get_pub(key);
        if (d != NULL) {
            len = ossl_ml_dsa_key_get_pub_len(key);
            if (!OSSL_PARAM_set_octet_string(p.pubkey, d, len))
                return 0;
        }
    }

    /*
     * This allows apps to use an empty digest, so that the old API
     * for digest signing can be used.
     */
    if (p.dgstp != NULL && !OSSL_PARAM_set_utf8_string(p.dgstp, ""))
        return 0;
    return 1;
}

static int ml_dsa_export(void *keydata, int selection,
    OSSL_CALLBACK *param_cb, void *cbarg)
{
    ML_DSA_KEY *key = keydata;
    OSSL_PARAM params[4];
    const uint8_t *buf;
    int include_private, pnum = 0;

    if (!ossl_prov_is_running() || key == NULL)
        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
        return 0;

    include_private = ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0);

    /*
     * Note that if the seed is present, both the seed and the private key are
     * exported.  The recipient will have a choice.
     */
    if (include_private) {
        if ((buf = ossl_ml_dsa_key_get_seed(key)) != NULL) {
            params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_ML_DSA_SEED, (void *)buf, ML_DSA_SEED_BYTES);
        }
        if ((buf = ossl_ml_dsa_key_get_priv(key)) != NULL) {
            params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PRIV_KEY, (void *)buf,
                ossl_ml_dsa_key_get_priv_len(key));
        }
    }
    if (((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
        && ((buf = ossl_ml_dsa_key_get_pub(key)) != NULL)) {
        params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PUB_KEY, (void *)buf,
            ossl_ml_dsa_key_get_pub_len(key));
    }
    if (pnum == 0)
        return 0;
    params[pnum] = OSSL_PARAM_construct_end();
    return param_cb(params, cbarg);
}

#ifndef FIPS_MODULE
static void *ml_dsa_load(const void *reference, size_t reference_sz)
{
    ML_DSA_KEY *key = NULL;
    const ML_DSA_PARAMS *key_params;
    const uint8_t *sk, *seed;

    if (ossl_prov_is_running() && reference_sz == sizeof(key)) {
        /* The contents of the reference is the address to our object */
        key = *(ML_DSA_KEY **)reference;
        /* We grabbed, so we detach it */
        *(ML_DSA_KEY **)reference = NULL;
        /* All done, if the pubkey is present. */
        if (key == NULL || ossl_ml_dsa_key_get_pub(key) != NULL)
            return key;
        /* Handle private prekey inputs. */
        sk = ossl_ml_dsa_key_get_priv(key);
        seed = ossl_ml_dsa_key_get_seed(key);
        if (seed != NULL
            && (sk == NULL || (ossl_ml_dsa_key_get_prov_flags(key) & ML_DSA_KEY_PREFER_SEED))) {
            if (ossl_ml_dsa_generate_key(key))
                return key;
        } else if (sk != NULL) {
            if (ossl_ml_dsa_sk_decode(key, sk,
                    ossl_ml_dsa_key_get_priv_len(key)))
                return key;
            key_params = ossl_ml_dsa_key_params(key);
            ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY,
                "error parsing %s private key",
                key_params->alg);
        } else {
            return key;
        }
    }

    ossl_ml_dsa_key_free(key);
    return NULL;
}
#endif

static void *ml_dsa_gen_init(void *provctx, int selection,
    const OSSL_PARAM params[])
{
    struct ml_dsa_gen_ctx *gctx = NULL;

    if (!ossl_prov_is_running())
        return NULL;

    if ((gctx = OPENSSL_zalloc(sizeof(*gctx))) != NULL) {
        gctx->provctx = provctx;
        if (!ml_dsa_gen_set_params(gctx, params)) {
            OPENSSL_free(gctx);
            gctx = NULL;
        }
    }
    return gctx;
}

static void *ml_dsa_gen(void *genctx, int evp_type)
{
    struct ml_dsa_gen_ctx *gctx = genctx;
    ML_DSA_KEY *key = NULL;

    if (!ossl_prov_is_running())
        return NULL;
    key = ossl_prov_ml_dsa_new(gctx->provctx, gctx->propq, evp_type);
    if (key == NULL)
        return NULL;
    if (gctx->entropy_len != 0
        && !ossl_ml_dsa_set_prekey(key, 0, 0,
            gctx->entropy, gctx->entropy_len, NULL, 0))
        goto err;
    if (!ossl_ml_dsa_generate_key(key)) {
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GENERATE_KEY);
        goto err;
    }
#ifdef FIPS_MODULE
    if (!ml_dsa_pairwise_test(key))
        goto err;
#endif
    return key;
err:
    ossl_ml_dsa_key_free(key);
    return NULL;
}

static int ml_dsa_gen_set_params(void *genctx, const OSSL_PARAM params[])
{
    struct ml_dsa_gen_ctx *gctx = genctx;
    struct ml_dsa_gen_set_params_st p;

    if (gctx == NULL || !ml_dsa_gen_set_params_decoder(params, &p))
        return 0;

    if (p.seed != NULL) {
        void *vp = gctx->entropy;
        size_t len = sizeof(gctx->entropy);

        if (!OSSL_PARAM_get_octet_string(p.seed, &vp, len, &(gctx->entropy_len))) {
            gctx->entropy_len = 0;
            return 0;
        }
    }

    if (p.propq != NULL) {
        OPENSSL_free(gctx->propq);
        gctx->propq = NULL;
        if (!OSSL_PARAM_get_utf8_string(p.propq, &gctx->propq, 0))
            return 0;
    }
    return 1;
}

static const OSSL_PARAM *ml_dsa_gen_settable_params(ossl_unused void *genctx,
    ossl_unused void *provctx)
{
    return ml_dsa_gen_set_params_list;
}

static void ml_dsa_gen_cleanup(void *genctx)
{
    struct ml_dsa_gen_ctx *gctx = genctx;

    if (gctx == NULL)
        return;

    OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy));
    OPENSSL_free(gctx->propq);
    OPENSSL_free(gctx);
}

#ifndef FIPS_MODULE
#define DISPATCH_LOAD_FN \
    { OSSL_FUNC_KEYMGMT_LOAD, (OSSL_FUNC)ml_dsa_load },
#else
#define DISPATCH_LOAD_FN /* Non-FIPS only */
#endif

#define MAKE_KEYMGMT_FUNCTIONS(alg)                                                           \
    static OSSL_FUNC_keymgmt_new_fn ml_dsa_##alg##_new_key;                                   \
    static OSSL_FUNC_keymgmt_gen_fn ml_dsa_##alg##_gen;                                       \
    static void *ml_dsa_##alg##_new_key(void *provctx)                                        \
    {                                                                                         \
        return ossl_prov_ml_dsa_new(provctx, NULL, EVP_PKEY_ML_DSA_##alg);                    \
    }                                                                                         \
    static void *ml_dsa_##alg##_new_key_ex(void *provctx, const OSSL_PARAM params[])          \
    {                                                                                         \
        return ossl_prov_ml_dsa_new_ex(provctx, params, EVP_PKEY_ML_DSA_##alg);               \
    }                                                                                         \
    static void *ml_dsa_##alg##_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)         \
    {                                                                                         \
        return ml_dsa_gen(genctx, EVP_PKEY_ML_DSA_##alg);                                     \
    }                                                                                         \
    const OSSL_DISPATCH ossl_ml_dsa_##alg##_keymgmt_functions[] = {                           \
        { OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))ml_dsa_##alg##_new_key },                    \
        { OSSL_FUNC_KEYMGMT_NEW_EX, (void (*)(void))ml_dsa_##alg##_new_key_ex },              \
        { OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))ml_dsa_free_key },                          \
        { OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))ml_dsa_has },                                \
        { OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))ml_dsa_match },                            \
        { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))ml_dsa_import },                          \
        { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))ml_dsa_import_types },              \
        { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))ml_dsa_export },                          \
        { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))ml_dsa_export_types },              \
        DISPATCH_LOAD_FN { OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*)(void))ml_dsa_get_params }, \
        { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*)(void))ml_dsa_gettable_params },        \
        { OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))ml_dsa_validate },                      \
        { OSSL_FUNC_KEYMGMT_GEN_INIT, (void (*)(void))ml_dsa_gen_init },                      \
        { OSSL_FUNC_KEYMGMT_GEN, (void (*)(void))ml_dsa_##alg##_gen },                        \
        { OSSL_FUNC_KEYMGMT_GEN_CLEANUP, (void (*)(void))ml_dsa_gen_cleanup },                \
        { OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS,                                                   \
            (void (*)(void))ml_dsa_gen_set_params },                                          \
        { OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS,                                              \
            (void (*)(void))ml_dsa_gen_settable_params },                                     \
        { OSSL_FUNC_KEYMGMT_DUP, (void (*)(void))ml_dsa_dup_key },                            \
        OSSL_KEYMGMT_FIPS_APPROVED_GEN_DISPATCH_END                                           \
    }

MAKE_KEYMGMT_FUNCTIONS(44);
MAKE_KEYMGMT_FUNCTIONS(65);
MAKE_KEYMGMT_FUNCTIONS(87);

Coverage Report

Created: 2026-10-16 07:07

Line	Count	Source
1		/*
2		* Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <openssl/core_dispatch.h>
11		#include <openssl/core_names.h>
12		#include <openssl/evp.h>
13		#include <openssl/param_build.h>
14		#include <openssl/proverr.h>
15		#include <openssl/self_test.h>
16		#include "crypto/ml_dsa.h"
17		#include "internal/fips.h"
18		#include "internal/param_build_set.h"
19		#include "prov/implementations.h"
20		#include "prov/providercommon.h"
21		#include "prov/provider_ctx.h"
22		#include "prov/ml_dsa.h"
23		#include "providers/implementations/keymgmt/keymgmtcommon.inc"
24
25		#define ml_dsa_export_params
26		#define ml_dsa_export_params_decoder
27		#include "providers/implementations/keymgmt/ml_dsa_kmgmt.inc"
28
29		static OSSL_FUNC_keymgmt_free_fn ml_dsa_free_key;
30		static OSSL_FUNC_keymgmt_has_fn ml_dsa_has;
31		static OSSL_FUNC_keymgmt_match_fn ml_dsa_match;
32		static OSSL_FUNC_keymgmt_import_fn ml_dsa_import;
33		static OSSL_FUNC_keymgmt_export_fn ml_dsa_export;
34		static OSSL_FUNC_keymgmt_import_types_fn ml_dsa_import_types;
35		static OSSL_FUNC_keymgmt_export_types_fn ml_dsa_export_types;
36		static OSSL_FUNC_keymgmt_dup_fn ml_dsa_dup_key;
37		static OSSL_FUNC_keymgmt_gettable_params_fn ml_dsa_gettable_params;
38		static OSSL_FUNC_keymgmt_validate_fn ml_dsa_validate;
39		static OSSL_FUNC_keymgmt_gen_init_fn ml_dsa_gen_init;
40		static OSSL_FUNC_keymgmt_gen_cleanup_fn ml_dsa_gen_cleanup;
41		static OSSL_FUNC_keymgmt_gen_set_params_fn ml_dsa_gen_set_params;
42		static OSSL_FUNC_keymgmt_gen_settable_params_fn ml_dsa_gen_settable_params;
43		#ifndef FIPS_MODULE
44		static OSSL_FUNC_keymgmt_load_fn ml_dsa_load;
45		#endif
46
47		struct ml_dsa_gen_ctx {
48		PROV_CTX *provctx;
49		char *propq;
50		uint8_t entropy[32];
51		size_t entropy_len;
52		};
53
54		#ifdef FIPS_MODULE
55		static int ml_dsa_pairwise_test(const ML_DSA_KEY *key)
56		{
57		OSSL_SELF_TEST *st = NULL;
58		OSSL_CALLBACK *cb = NULL;
59		OSSL_LIB_CTX *ctx;
60		void *cbarg = NULL;
61		static const uint8_t msg[] = { 80, 108, 117, 103, 104 };
62		uint8_t rnd[ML_DSA_ENTROPY_LEN];
63		uint8_t sig[ML_DSA_87_SIG_LEN];
64		size_t sig_len = 0;
65		int ret = 0;
66
67		if (!ml_dsa_has(key, OSSL_KEYMGMT_SELECT_KEYPAIR)
68		\|\| ossl_fips_self_testing()
69		\|\| ossl_self_test_in_progress(ST_ID_ASYM_KEYGEN_ML_DSA))
70		return 1;
71
72		/*
73		* The functions `OSSL_SELF_TEST_*` will return directly if parameter `st`
74		* is NULL.
75		*/
76		ctx = ossl_ml_dsa_key_get0_libctx(key);
77		OSSL_SELF_TEST_get_callback(ctx, &cb, &cbarg);
78
79		if ((st = OSSL_SELF_TEST_new(cb, cbarg)) == NULL)
80		return 0;
81
82		OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT,
83		OSSL_SELF_TEST_DESC_PCT_ML_DSA);
84
85		memset(rnd, 0, sizeof(rnd));
86		memset(sig, 0, sizeof(sig));
87
88		if (ossl_ml_dsa_sign(key, 0, msg, sizeof(msg), NULL, 0, rnd, sizeof(rnd), 0,
89		sig, &sig_len, sizeof(sig))
90		<= 0)
91		goto err;
92
93		OSSL_SELF_TEST_oncorrupt_byte(st, sig);
94
95		if (ossl_ml_dsa_verify(key, 0, msg, sizeof(msg), NULL, 0, 0,
96		sig, sig_len)
97		<= 0)
98		goto err;
99
100		ret = 1;
101		err:
102		OSSL_SELF_TEST_onend(st, ret);
103		OSSL_SELF_TEST_free(st);
104		OPENSSL_cleanse(sig, sizeof(sig));
105		return ret;
106		}
107		#endif
108
109		ML_DSA_KEY ossl_prov_ml_dsa_new(PROV_CTX ctx, const char *propq, int evp_type)
110	0	{
111	0	ML_DSA_KEY *key;
112
113	0	if (!ossl_prov_is_running())
114	0	return 0;
115
116		#ifdef FIPS_MODULE
117		if (!ossl_deferred_self_test(PROV_LIBCTX_OF(ctx),
118		ST_ID_ASYM_KEYGEN_ML_DSA))
119		return NULL;
120		#endif
121
122	0	key = ossl_ml_dsa_key_new(PROV_LIBCTX_OF(ctx), propq, evp_type);
123		/*
124		* When decoding, if the key ends up "loaded" into the same provider, these
125		* are the correct config settings, otherwise, new values will be assigned
126		* on import into a different provider. The "load" API does not pass along
127		* the provider context.
128		*/
129	0	if (key != NULL) {
130	0	int flags_set = 0, flags_clr = 0;
131
132	0	if (ossl_prov_ctx_get_bool_param(
133	0	ctx, OSSL_PKEY_PARAM_ML_DSA_RETAIN_SEED, 1))
134	0	flags_set \|= ML_DSA_KEY_RETAIN_SEED;
135	0	else
136	0	flags_clr = ML_DSA_KEY_RETAIN_SEED;
137
138	0	if (ossl_prov_ctx_get_bool_param(
139	0	ctx, OSSL_PKEY_PARAM_ML_DSA_PREFER_SEED, 1))
140	0	flags_set \|= ML_DSA_KEY_PREFER_SEED;
141	0	else
142	0	flags_clr \|= ML_DSA_KEY_PREFER_SEED;
143
144	0	ossl_ml_dsa_set_prekey(key, flags_set, flags_clr, NULL, 0, NULL, 0);
145	0	}
146	0	return key;
147	0	}
148
149		static ML_DSA_KEY ossl_prov_ml_dsa_new_ex(PROV_CTX ctx, const OSSL_PARAM params[], int evp_type)
150	0	{
151	0	struct ml_dsa_new_key_ex_params_st p;
152	0	const char *propq = NULL;
153
154	0	if (!ml_dsa_new_key_ex_params_decoder(params, &p))
155	0	return 0;
156
157	0	if (p.propq != NULL) {
158	0	if (p.propq->data_type != OSSL_PARAM_UTF8_STRING)
159	0	return 0;
160	0	propq = p.propq->data;
161	0	}
162
163	0	return ossl_prov_ml_dsa_new(ctx, propq, evp_type);
164	0	}
165
166		static void ml_dsa_free_key(void *keydata)
167	0	{
168	0	ossl_ml_dsa_key_free((ML_DSA_KEY *)keydata);
169	0	}
170
171		static void ml_dsa_dup_key(const void keydata_from, int selection)
172	0	{
173	0	if (ossl_prov_is_running())
174	0	return ossl_ml_dsa_key_dup(keydata_from, selection);
175	0	return NULL;
176	0	}
177
178		static int ml_dsa_has(const void *keydata, int selection)
179	0	{
180	0	const ML_DSA_KEY *key = keydata;
181
182	0	if (!ossl_prov_is_running() \|\| key == NULL)
183	0	return 0;
184	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
185	0	return 1; /* the selection is not missing */
186
187	0	return ossl_ml_dsa_key_has(key, selection);
188	0	}
189
190		static int ml_dsa_match(const void keydata1, const void keydata2, int selection)
191	0	{
192	0	const ML_DSA_KEY *key1 = keydata1;
193	0	const ML_DSA_KEY *key2 = keydata2;
194
195	0	if (!ossl_prov_is_running())
196	0	return 0;
197	0	if (key1 == NULL \|\| key2 == NULL)
198	0	return 0;
199	0	return ossl_ml_dsa_key_equal(key1, key2, selection);
200	0	}
201
202		static int ml_dsa_validate(const void *key_data, int selection, int check_type)
203	0	{
204	0	const ML_DSA_KEY *key = key_data;
205
206	0	if (!ml_dsa_has(key, selection))
207	0	return 0;
208
209	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_KEYPAIR)
210	0	return ossl_ml_dsa_key_pairwise_check(key);
211	0	return 1;
212	0	}
213
214		/**
215		* @brief Load a ML_DSA key from raw data.
216		*
217		* @param key An ML_DSA key to load into
218		* @param params An array of parameters containing key data.
219		* @param include_private Set to 1 to optionally include the private key data
220		* if it exists.
221		* @returns 1 on success, or 0 on failure.
222		*/
223		static int ml_dsa_key_fromdata(ML_DSA_KEY *key, const OSSL_PARAM params[],
224		int include_private)
225	0	{
226	0	const ML_DSA_PARAMS *key_params = ossl_ml_dsa_key_params(key);
227	0	const uint8_t pk = NULL, sk = NULL, *seed = NULL;
228	0	size_t pk_len = 0, sk_len = 0, seed_len = 0;
229	0	struct ml_dsa_import_params_st p;
230
231	0	if (!ml_dsa_import_params_decoder(params, &p))
232	0	return 0;
233
234	0	if (p.pubkey != NULL) {
235	0	if (!OSSL_PARAM_get_octet_string_ptr(p.pubkey, (const void **)&pk, &pk_len))
236	0	return 0;
237	0	if (pk_len != 0 && pk_len != key_params->pk_len) {
238	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH,
239	0	"Invalid %s public key length", key_params->alg);
240	0	return 0;
241	0	}
242	0	}
243
244		/* Private key seed is optional */
245	0	if (p.seed != NULL && include_private) {
246	0	if (!OSSL_PARAM_get_octet_string_ptr(p.seed, (const void **)&seed,
247	0	&seed_len))
248	0	return 0;
249	0	if (seed_len != 0 && seed_len != ML_DSA_SEED_BYTES) {
250	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
251	0	return 0;
252	0	}
253	0	}
254
255		/* Private key is optional */
256	0	if (p.privkey != NULL && include_private) {
257	0	if (!OSSL_PARAM_get_octet_string_ptr(p.privkey, (const void **)&sk,
258	0	&sk_len))
259	0	return 0;
260	0	if (sk_len != 0 && sk_len != key_params->sk_len) {
261	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH,
262	0	"Invalid %s private key length",
263	0	key_params->alg);
264	0	return 0;
265	0	}
266	0	}
267
268		/* The caller MUST specify at least one of seed, private or public keys. */
269	0	if (seed_len == 0 && pk_len == 0 && sk_len == 0) {
270	0	ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
271	0	return 0;
272	0	}
273
274	0	if (p.propq != NULL) {
275	0	if (p.propq->data_type != OSSL_PARAM_UTF8_STRING)
276	0	return 0;
277	0	if (!ossl_ml_dsa_key_fetch_digests(key, p.propq->data))
278	0	return 0;
279	0	}
280	0	if (seed_len != 0
281	0	&& (sk_len == 0
282	0	\|\| (ossl_ml_dsa_key_get_prov_flags(key) & ML_DSA_KEY_PREFER_SEED))) {
283	0	if (!ossl_ml_dsa_set_prekey(key, 0, 0, seed, seed_len, sk, sk_len))
284	0	return 0;
285	0	if (!ossl_ml_dsa_generate_key(key)) {
286	0	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GENERATE_KEY);
287	0	return 0;
288	0	}
289	0	} else if (sk_len > 0) {
290	0	if (!ossl_ml_dsa_sk_decode(key, sk, sk_len))
291	0	return 0;
292	0	} else if (pk_len > 0) {
293	0	if (!ossl_ml_dsa_pk_decode(key, pk, pk_len))
294	0	return 0;
295	0	}
296
297		/* Error if the supplied public key does not match the generated key */
298	0	if (pk_len == 0
299	0	\|\| seed_len + sk_len == 0
300	0	\|\| memcmp(ossl_ml_dsa_key_get_pub(key), pk, pk_len) == 0)
301	0	return 1;
302	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY,
303	0	"explicit %s public key does not match private",
304	0	key_params->alg);
305	0	ossl_ml_dsa_key_reset(key);
306	0	return 0;
307	0	}
308
309		static int ml_dsa_import(void *keydata, int selection, const OSSL_PARAM params[])
310	0	{
311	0	ML_DSA_KEY *key = keydata;
312	0	int include_priv;
313	0	int res;
314
315		/*
316		* Once a key is fully initialised (has at least a public component),
317		* further mutation is no longer safe and disallowed.
318		*/
319	0	if (!ossl_prov_is_running() \|\| key == NULL)
320	0	return 0;
321	0	if (ossl_ml_dsa_key_has(key, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)) {
322		/* Invalid attempt to mutate a key. */
323	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_KEY_IMMUTABLE_ONCE_SET,
324	0	"Keys are immutable once key material has been loaded or generated");
325	0	return 0;
326	0	}
327
328	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
329	0	return 0;
330
331	0	include_priv = ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0);
332	0	res = ml_dsa_key_fromdata(key, params, include_priv);
333		#ifdef FIPS_MODULE
334		if (res > 0) {
335		res = ml_dsa_pairwise_test(key);
336		if (!res)
337		ossl_ml_dsa_key_reset(key);
338		}
339		#endif /* FIPS_MODULE */
340	0	return res;
341	0	}
342
343		static const OSSL_PARAM *ml_dsa_import_types(int selection)
344	0	{
345	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
346	0	return NULL;
347	0	return ml_dsa_import_params_list;
348	0	}
349
350		static const OSSL_PARAM *ml_dsa_export_types(int selection)
351	0	{
352	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
353	0	return NULL;
354	0	return ml_dsa_export_params_list;
355	0	}
356
357		static const OSSL_PARAM ml_dsa_gettable_params(void provctx)
358	0	{
359	0	return ml_dsa_get_params_list;
360	0	}
361
362		static int ml_dsa_get_params(void *keydata, OSSL_PARAM params[])
363	0	{
364	0	ML_DSA_KEY *key = keydata;
365	0	const uint8_t *d;
366	0	size_t len;
367	0	struct ml_dsa_get_params_st p;
368
369	0	if (key == NULL \|\| !ml_dsa_get_params_decoder(params, &p))
370	0	return 0;
371
372	0	if (p.bits != NULL
373	0	&& !OSSL_PARAM_set_size_t(p.bits, 8 * ossl_ml_dsa_key_get_pub_len(key)))
374	0	return 0;
375
376	0	if (p.secbits != NULL
377	0	&& !OSSL_PARAM_set_size_t(p.secbits, ossl_ml_dsa_key_get_collision_strength_bits(key)))
378	0	return 0;
379
380	0	if (p.maxsize != NULL
381	0	&& !OSSL_PARAM_set_size_t(p.maxsize, ossl_ml_dsa_key_get_sig_len(key)))
382	0	return 0;
383
384	0	if (p.seccat != NULL
385	0	&& !OSSL_PARAM_set_int(p.seccat, ossl_ml_dsa_key_get_security_category(key)))
386	0	return 0;
387
388	0	if (p.seed != NULL) {
389	0	d = ossl_ml_dsa_key_get_seed(key);
390	0	if (d != NULL && !OSSL_PARAM_set_octet_string(p.seed, d, ML_DSA_SEED_BYTES))
391	0	return 0;
392	0	}
393
394	0	if (p.privkey != NULL) {
395	0	d = ossl_ml_dsa_key_get_priv(key);
396	0	if (d != NULL) {
397	0	len = ossl_ml_dsa_key_get_priv_len(key);
398	0	if (!OSSL_PARAM_set_octet_string(p.privkey, d, len))
399	0	return 0;
400	0	}
401	0	}
402
403	0	if (p.pubkey != NULL) {
404	0	d = ossl_ml_dsa_key_get_pub(key);
405	0	if (d != NULL) {
406	0	len = ossl_ml_dsa_key_get_pub_len(key);
407	0	if (!OSSL_PARAM_set_octet_string(p.pubkey, d, len))
408	0	return 0;
409	0	}
410	0	}
411
412		/*
413		* This allows apps to use an empty digest, so that the old API
414		* for digest signing can be used.
415		*/
416	0	if (p.dgstp != NULL && !OSSL_PARAM_set_utf8_string(p.dgstp, ""))
417	0	return 0;
418	0	return 1;
419	0	}
420
421		static int ml_dsa_export(void *keydata, int selection,
422		OSSL_CALLBACK param_cb, void cbarg)
423	0	{
424	0	ML_DSA_KEY *key = keydata;
425	0	OSSL_PARAM params[4];
426	0	const uint8_t *buf;
427	0	int include_private, pnum = 0;
428
429	0	if (!ossl_prov_is_running() \|\| key == NULL)
430	0	return 0;
431
432	0	if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
433	0	return 0;
434
435	0	include_private = ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0);
436
437		/*
438		* Note that if the seed is present, both the seed and the private key are
439		* exported. The recipient will have a choice.
440		*/
441	0	if (include_private) {
442	0	if ((buf = ossl_ml_dsa_key_get_seed(key)) != NULL) {
443	0	params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_ML_DSA_SEED, (void *)buf, ML_DSA_SEED_BYTES);
444	0	}
445	0	if ((buf = ossl_ml_dsa_key_get_priv(key)) != NULL) {
446	0	params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PRIV_KEY, (void *)buf,
447	0	ossl_ml_dsa_key_get_priv_len(key));
448	0	}
449	0	}
450	0	if (((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
451	0	&& ((buf = ossl_ml_dsa_key_get_pub(key)) != NULL)) {
452	0	params[pnum++] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PUB_KEY, (void *)buf,
453	0	ossl_ml_dsa_key_get_pub_len(key));
454	0	}
455	0	if (pnum == 0)
456	0	return 0;
457	0	params[pnum] = OSSL_PARAM_construct_end();
458	0	return param_cb(params, cbarg);
459	0	}
460
461		#ifndef FIPS_MODULE
462		static void ml_dsa_load(const void reference, size_t reference_sz)
463	0	{
464	0	ML_DSA_KEY *key = NULL;
465	0	const ML_DSA_PARAMS *key_params;
466	0	const uint8_t sk, seed;
467
468	0	if (ossl_prov_is_running() && reference_sz == sizeof(key)) {
469		/* The contents of the reference is the address to our object */
470	0	key = (ML_DSA_KEY *)reference;
471		/* We grabbed, so we detach it */
472	0	(ML_DSA_KEY *)reference = NULL;
473		/* All done, if the pubkey is present. */
474	0	if (key == NULL \|\| ossl_ml_dsa_key_get_pub(key) != NULL)
475	0	return key;
476		/* Handle private prekey inputs. */
477	0	sk = ossl_ml_dsa_key_get_priv(key);
478	0	seed = ossl_ml_dsa_key_get_seed(key);
479	0	if (seed != NULL
480	0	&& (sk == NULL \|\| (ossl_ml_dsa_key_get_prov_flags(key) & ML_DSA_KEY_PREFER_SEED))) {
481	0	if (ossl_ml_dsa_generate_key(key))
482	0	return key;
483	0	} else if (sk != NULL) {
484	0	if (ossl_ml_dsa_sk_decode(key, sk,
485	0	ossl_ml_dsa_key_get_priv_len(key)))
486	0	return key;
487	0	key_params = ossl_ml_dsa_key_params(key);
488	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_KEY,
489	0	"error parsing %s private key",
490	0	key_params->alg);
491	0	} else {
492	0	return key;
493	0	}
494	0	}
495
496	0	ossl_ml_dsa_key_free(key);
497	0	return NULL;
498	0	}
499		#endif
500
501		static void ml_dsa_gen_init(void provctx, int selection,
502		const OSSL_PARAM params[])
503	0	{
504	0	struct ml_dsa_gen_ctx *gctx = NULL;
505
506	0	if (!ossl_prov_is_running())
507	0	return NULL;
508
509	0	if ((gctx = OPENSSL_zalloc(sizeof(*gctx))) != NULL) {
510	0	gctx->provctx = provctx;
511	0	if (!ml_dsa_gen_set_params(gctx, params)) {
512	0	OPENSSL_free(gctx);
513	0	gctx = NULL;
514	0	}
515	0	}
516	0	return gctx;
517	0	}
518
519		static void ml_dsa_gen(void genctx, int evp_type)
520	0	{
521	0	struct ml_dsa_gen_ctx *gctx = genctx;
522	0	ML_DSA_KEY *key = NULL;
523
524	0	if (!ossl_prov_is_running())
525	0	return NULL;
526	0	key = ossl_prov_ml_dsa_new(gctx->provctx, gctx->propq, evp_type);
527	0	if (key == NULL)
528	0	return NULL;
529	0	if (gctx->entropy_len != 0
530	0	&& !ossl_ml_dsa_set_prekey(key, 0, 0,
531	0	gctx->entropy, gctx->entropy_len, NULL, 0))
532	0	goto err;
533	0	if (!ossl_ml_dsa_generate_key(key)) {
534	0	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GENERATE_KEY);
535	0	goto err;
536	0	}
537		#ifdef FIPS_MODULE
538		if (!ml_dsa_pairwise_test(key))
539		goto err;
540		#endif
541	0	return key;
542	0	err:
543	0	ossl_ml_dsa_key_free(key);
544	0	return NULL;
545	0	}
546
547		static int ml_dsa_gen_set_params(void *genctx, const OSSL_PARAM params[])
548	0	{
549	0	struct ml_dsa_gen_ctx *gctx = genctx;
550	0	struct ml_dsa_gen_set_params_st p;
551
552	0	if (gctx == NULL \|\| !ml_dsa_gen_set_params_decoder(params, &p))
553	0	return 0;
554
555	0	if (p.seed != NULL) {
556	0	void *vp = gctx->entropy;
557	0	size_t len = sizeof(gctx->entropy);
558
559	0	if (!OSSL_PARAM_get_octet_string(p.seed, &vp, len, &(gctx->entropy_len))) {
560	0	gctx->entropy_len = 0;
561	0	return 0;
562	0	}
563	0	}
564
565	0	if (p.propq != NULL) {
566	0	OPENSSL_free(gctx->propq);
567	0	gctx->propq = NULL;
568	0	if (!OSSL_PARAM_get_utf8_string(p.propq, &gctx->propq, 0))
569	0	return 0;
570	0	}
571	0	return 1;
572	0	}
573
574		static const OSSL_PARAM ml_dsa_gen_settable_params(ossl_unused void genctx,
575		ossl_unused void *provctx)
576	0	{
577	0	return ml_dsa_gen_set_params_list;
578	0	}
579
580		static void ml_dsa_gen_cleanup(void *genctx)
581	0	{
582	0	struct ml_dsa_gen_ctx *gctx = genctx;
583
584	0	if (gctx == NULL)
585	0	return;
586
587	0	OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy));
588	0	OPENSSL_free(gctx->propq);
589	0	OPENSSL_free(gctx);
590	0	}
591
592		#ifndef FIPS_MODULE
593		#define DISPATCH_LOAD_FN \
594		{ OSSL_FUNC_KEYMGMT_LOAD, (OSSL_FUNC)ml_dsa_load },
595		#else
596		#define DISPATCH_LOAD_FN /* Non-FIPS only */
597		#endif
598
599		#define MAKE_KEYMGMT_FUNCTIONS(alg) \
600		static OSSL_FUNC_keymgmt_new_fn ml_dsa_##alg##_new_key; \
601		static OSSL_FUNC_keymgmt_gen_fn ml_dsa_##alg##_gen; \
602		static void ml_dsa_##alg##_new_key(void provctx) \
603	0	{ \
604	0	return ossl_prov_ml_dsa_new(provctx, NULL, EVP_PKEY_ML_DSA_##alg); \
605	0	} \
606		static void ml_dsa_##alg##_new_key_ex(void provctx, const OSSL_PARAM params[]) \
607	0	{ \
608	0	return ossl_prov_ml_dsa_new_ex(provctx, params, EVP_PKEY_ML_DSA_##alg); \
609	0	} \ Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_44_new_key_ex Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_65_new_key_ex Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_87_new_key_ex
610		static void ml_dsa_##alg##_gen(void genctx, OSSL_CALLBACK osslcb, void cbarg) \
611	0	{ \
612	0	return ml_dsa_gen(genctx, EVP_PKEY_ML_DSA_##alg); \
613	0	} \ Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_44_gen Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_65_gen Unexecuted instantiation: ml_dsa_kmgmt.c:ml_dsa_87_gen
614		const OSSL_DISPATCH ossl_ml_dsa_##alg##_keymgmt_functions[] = { \
615		{ OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))ml_dsa_##alg##_new_key }, \
616		{ OSSL_FUNC_KEYMGMT_NEW_EX, (void (*)(void))ml_dsa_##alg##_new_key_ex }, \
617		{ OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))ml_dsa_free_key }, \
618		{ OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))ml_dsa_has }, \
619		{ OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))ml_dsa_match }, \
620		{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))ml_dsa_import }, \
621		{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))ml_dsa_import_types }, \
622		{ OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))ml_dsa_export }, \
623		{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))ml_dsa_export_types }, \
624		DISPATCH_LOAD_FN { OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*)(void))ml_dsa_get_params }, \
625		{ OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*)(void))ml_dsa_gettable_params }, \
626		{ OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))ml_dsa_validate }, \
627		{ OSSL_FUNC_KEYMGMT_GEN_INIT, (void (*)(void))ml_dsa_gen_init }, \
628		{ OSSL_FUNC_KEYMGMT_GEN, (void (*)(void))ml_dsa_##alg##_gen }, \
629		{ OSSL_FUNC_KEYMGMT_GEN_CLEANUP, (void (*)(void))ml_dsa_gen_cleanup }, \
630		{ OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS, \
631		(void (*)(void))ml_dsa_gen_set_params }, \
632		{ OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS, \
633		(void (*)(void))ml_dsa_gen_settable_params }, \
634		{ OSSL_FUNC_KEYMGMT_DUP, (void (*)(void))ml_dsa_dup_key }, \
635		OSSL_KEYMGMT_FIPS_APPROVED_GEN_DISPATCH_END \
636		}
637
638	0	MAKE_KEYMGMT_FUNCTIONS(44);
639	0	MAKE_KEYMGMT_FUNCTIONS(65);
640		MAKE_KEYMGMT_FUNCTIONS(87);