Signed CMS for SLH-DSA #115310

PranavSenthilnathan · 2025-05-05T18:36:29Z

This PR forks Sign and Verify into a Pure and Hash mode with the Hash mode being the same as the existing implementation. Additionally it adds support for SHAKE128 and SHAKE256 as digest algorithms in CMS.

Some design decisions:

The SLH-DSA CMS spec says that the content-type attribute MUST be present for for SLH-DSA. However for counter-signing , RFC 5652 says that counter-signers must not have a content-type attribute. This PR follows RFC 5652.
When SubjectIdentifierType.NoSignature is specified, we will check whether the signing algorithm is SLH-DSA and throw if it is. Otherwise we will just use the hash as the signature as before. If Windows has a different behavior for NetFx, we will just adopt it since we don't have an opinion here.
Same policy for CheckHash.
It's up to the user to specify and/or check the digest algorithm. We do not place any restrictions on hash strength during signing or verification.
NetFx public API stays the same and new APIs are added for .NET and netstandard2.1. OpenSsl cannot be supported downlevel but Windows will likely be. This depends on the cert accessors in Microsoft.Bcl.Cryptography which in turn depends on the Windows PQC APIs, so it is not implemented yet.

CMS for SLH-DSA successfully roundtrips with openssl (message created with SignedCms can be verified with OpenSsl and vice versa).

ghost · 2025-05-05T18:36:36Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

ghost · 2025-05-05T18:36:37Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

dotnet-policy-service · 2025-05-05T18:37:11Z

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

vcsjones · 2025-05-05T19:46:57Z

Are we going to support NET Framework?

SignedCms and all of its associated types type-forward to the .NET Framework implementation. We can't enable it on .NET Framework through System.Security.Cryptography.Pkcs. Whatever work that needs to be done (if any) will need to be done in .NET Framework itself.

runtime/src/libraries/System.Security.Cryptography.Pkcs/ref/System.Security.Cryptography.Pkcs.netframework.cs

Line 33 in 86949c2

    
           [assembly: TypeForwardedTo(typeof(System.Security.Cryptography.Pkcs.SignedCms))]

vcsjones · 2025-05-05T20:00:45Z

I am curious if we need to implement any of this down level, since .NET Framework will have its own implementation.

I... think... it probably could make sense to implement all of the new public API surface as #if NET10_0_OR_GREATER and don't implement it down level at all.

>= net462 TFMs are going to get type-forwarded.
<= net9.0 TFMs won't have the new public API. That's okay, they should just move to .NET 10. .NET (Core) users should expect to require updating to get new capabilities.
>= netstandard2.0 this is where... maybe... there is value in doing the OOB. If someone is on netstandard and on Windows, but not .NET Framework and not .NET Core, then down level support might be justified. The one that has come up in the past is UWP.

...raries/System.Security.Cryptography.Pkcs/ref/System.Security.Cryptography.Pkcs.netcoreapp.cs

...stem.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.SlhDsa.cs

...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.cs

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

PranavSenthilnathan · 2025-05-07T21:09:54Z

<= net9.0 TFMs won't have the new public API. That's okay, they should just move to .NET 10. .NET (Core) users should expect to require updating to get new capabilities.

For Unix, downlevel won't work because we don't have the key accessors on certs for openssl in Microsoft.Bcl.Cryptography. However, I think we can still support Windows downlevel (net8.0 and net9.0) since the accessors will be available for them.

>= netstandard2.0 this is where... maybe... there is value in doing the OOB. If someone is on netstandard and on Windows, but not .NET Framework and not .NET Core, then down level support might be justified. The one that has come up in the past is UWP.

After talking to @bartonjs about this: netstandard2.0 should have the same API as NetFx so that means no public API changes. I think netstandard2.1 is more at our discretion and I just added the public API for now.

...ryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs

.../System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.DSA.cs

...libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsHash.cs

vcsjones · 2025-05-08T20:18:39Z

...ryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs

+        /// <exception cref="CryptographicException">
+        ///   The public key was invalid, or otherwise could not be imported.
+        /// </exception>
+        [ExperimentalAttribute("SYSLIB5006")]


This should use the const (and UrlFormat, as being introduced in #115412)

[Experimental(Experimentals.PostQuantumCryptographyDiagId)]

@barotnjs I don't know where we landed on this - but shouldn't the experimental be on the class? Like, if we ship the class it would, technically, be an unguarded breaking change for us to remove it, if we needed to.

If we put it on the class, but then mark ML-DSA (or whatever) as "not Experimental" while one of the rest still is, we have to be diligent at moving the Experimentals down to each remaining member.

We could also put it on the class until there's one stable member so that we don't end up with "well, we deleted everything, because all of PQC got abandoned by the industry before the specs all went final-stable.... so now we have this empty static class"... but I don't really see that outcome, so I don't feel like the class-level one is warranted.

We could also put it on the class until there's one stable member so that we don't end up with "well, we deleted everything, because all of PQC got abandoned by the industry before the specs all went final-stable.

More like, "It turns out that extensions are not the right shape for [whatever reason]" but, okay.

vcsjones · 2025-05-08T20:20:42Z

...ryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs

+    /// <summary>
+    /// Helper methods to access keys on <see cref="X509Certificate2"/>.
+    /// </summary>
+    public static class X509CertificateKeyAccessors


Maybe we should EB-Never this for .NET 10+?

vcsjones · 2025-05-08T20:23:44Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+    public static class X509CertificateKeyAccessorsTests
+    {
+        [ConditionalFact(typeof(SlhDsa), nameof(SlhDsa.IsSupported))]
+        public static void GetPublicKey()


Since we are using a single class for all of the algorithm names, the tests here should have SLH-DSA somewhere in the test name (repeat feedback for all tests in fixture)

vcsjones · 2025-05-08T20:25:49Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+#else
+            // Unix: OpenSsl accessors not supported downlevel
+            // Windows: SlhDsa currently not supported so test won't execute
+            Assert.Throws<PlatformNotSupportedException>(() => X509CertificateKeyAccessors.GetSlhDsaPrivateKey(null));


Will this assert even be hit because it's a ConditionalFact?

Windows returns false right now....

OOB Linux should return false right now...

So I am failing to see when this #else will be hit.

vcsjones · 2025-05-08T20:26:36Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+                X509Certificate2 copied = X509CertificateKeyAccessors.CopyWithPrivateKey(cert, privateKey);
+                AssertExtensions.TrueExpression(copied.HasPrivateKey);
+
+                SlhDsa? copiedKey = copied.GetSlhDsaPrivateKey();


We should dispose of the cert and the key.

vcsjones · 2025-05-08T20:37:31Z

...es/System.Security.Cryptography.Pkcs/src/Internal/Cryptography/Pal/Windows/PkcsPalWindows.cs

@@ -177,6 +179,8 @@ public sealed override byte[] GetSubjectKeyIdentifier(X509Certificate2 certifica
                    return (T)(object)new RSACryptoServiceProvider(cspParams);
                if (typeof(T) == typeof(DSA))
                    return (T)(object)new DSACryptoServiceProvider(cspParams);
+                if (typeof(T) == typeof(SlhDsa))


I don't think this if is ever going to be hit because this is the CAPI path and I would be... surprised... if and PQC types worked with CAPI. ECDsa doesn't, either, which is why ECDsa is not here.

vcsjones · 2025-05-08T20:38:43Z

src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">


I think this is adding a BOM. We try to keep BOMs out of this repo, if I remember correctly.

vcsjones · 2025-05-08T20:47:01Z

...libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsHash.cs

+            // RFC 8702 specifies SHAKE256 in CMS must use 512 bits of output.
+            private const int OutputSizeBytes = 512 / 8;
+
+            private readonly Shake256 _shake256;


YESSS. Finally some use of SHAKE!

Note that we did not OOB any of the SHA-3 APIs. So, if you think this is going to be needed to make CMS work for .NET Standard or .NET 9, then the Shake API's won't be available.

vcsjones · 2025-05-08T20:51:46Z

...stem.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.SlhDsa.cs

+                // The spec (as of May 5, 2025) has strength requirements on the hash, but we will
+                // not enforce them here. If the callers wants to enforce them, they can do so by themselves.
+
+                SlhDsa? publicKey = certificate.GetSlhDsaPublicKey();


We didn't get set a good example in the other algorithms, but this should be disposed (The classic-crypto algs can be cleaned up in a separate PR. Maybe we should make an issue for that?)

bartonjs · 2025-05-08T19:56:38Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+    public static class X509CertificateKeyAccessorsTests
+    {
+        [ConditionalFact(typeof(SlhDsa), nameof(SlhDsa.IsSupported))]
+        public static void GetPublicKey()


Suggested change

public static void GetPublicKey()

public static void GetSlhDsaPublicKey()

bartonjs · 2025-05-08T19:59:11Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+            {
+                Assert.NotNull(certKey);
+                AssertExtensions.SequenceEqual(SlhDsaTestData.IetfSlhDsaSha2_128sPublicKeyValue, certKey.ExportSlhDsaPublicKey());
+            }


This shows that it exports the correct public key, but not that it's not a private key.

It should look for a CryptographicException from signing something. (Looking for an exception from exporting the private key isn't quite right, since that would also happen from a non-exportable private key... though X509Certificate2.CreateFromPem shouldn't make one of those).

bartonjs · 2025-05-08T20:00:36Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+#else
+            // Unix: OpenSsl accessors not supported downlevel
+            // Windows: SlhDsa currently not supported so test won't execute
+            Assert.Throws<PlatformNotSupportedException>(() => X509CertificateKeyAccessors.GetSlhDsaPrivateKey(null));


The test is already conditional on SlhDsa.IsSupported. So why is it using #if, and why would it expect failure?

bartonjs · 2025-05-08T20:46:40Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+        {
+#if NET10_0_OR_GREATER
+            string certPem = PemEncoding.WriteString("CERTIFICATE", SlhDsaTestData.IetfSlhDsaSha2_128sCertificate);
+            using (X509Certificate2 cert = X509Certificate2.CreateFromPem(certPem))


The test should also check that GetSlhDsaPublicKey is returning a public-only key when a private key is available.

bartonjs · 2025-05-08T20:47:15Z

...raries/Microsoft.Bcl.Cryptography/tests/X509Certificates/X509CertificateKeyAccessorsTests.cs

+        }
+
+        [ConditionalFact(typeof(SlhDsa), nameof(SlhDsa.IsSupported))]
+        public static void GetPrivateKey()


Suggested change

public static void GetPrivateKey()

public static void GetSlhDsaPrivateKey()

bartonjs · 2025-05-08T20:51:28Z

...ryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs

+        /// <exception cref="CryptographicException">
+        ///   The public key was invalid, or otherwise could not be imported.
+        /// </exception>
+        [ExperimentalAttribute("SYSLIB5006")]


If we put it on the class, but then mark ML-DSA (or whatever) as "not Experimental" while one of the rest still is, we have to be diligent at moving the Experimentals down to each remaining member.

We could also put it on the class until there's one stable member so that we don't end up with "well, we deleted everything, because all of PQC got abandoned by the industry before the specs all went final-stable.... so now we have this empty static class"... but I don't really see that outcome, so I don't feel like the class-level one is warranted.

vcsjones · 2025-05-08T20:53:40Z

...stem.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.SlhDsa.cs

+                signatureParameters = null;
+
+                // If there's no private key, fall back to the public key for a "no private key" exception.
+                SlhDsa? signingKey = key as SlhDsa ??


Likewise, more algorithms need to be disposed (and cleanup for the others can happen separately)

Just have to be careful here to not dispose of the key if it was passed in externally.

// If there's no private key, fall back to the public key for a "no private key" exception.

Seems like a roundabout way of doing it... can we just throw here ourselves or do we prefer the exception coming from the cert?

Since this has a type forward to .NET Framework, we try to be exception compatible with .NET Framework, and this is what .NET Framework does.

refactor signed cms for pure and hashed signing

ae0e013

PranavSenthilnathan requested a review from bartonjs May 5, 2025 18:36

PranavSenthilnathan self-assigned this May 5, 2025

PranavSenthilnathan added the area-System.Security label May 5, 2025

ghost added the new-api-needs-documentation label May 5, 2025

bartonjs reviewed May 5, 2025

View reviewed changes

...raries/System.Security.Cryptography.Pkcs/ref/System.Security.Cryptography.Pkcs.netcoreapp.cs Outdated Show resolved Hide resolved

This was referenced May 5, 2025

[wasm][AOT] emcc : error - received SIGKILL (-9) #89402

Open

SIGKILL System.Runtime.Serialization.Formatters.Tests #114287

Open

bartonjs reviewed May 5, 2025

View reviewed changes

support shake hash

1f2a854

PranavSenthilnathan changed the title ~~Initial draft of signed CMS for SLH-DSA~~ Signed CMS for SLH-DSA May 7, 2025

PranavSenthilnathan marked this pull request as ready for review May 7, 2025 21:23

PranavSenthilnathan added 2 commits May 7, 2025 18:04

merge

6af2d07

fix build after merge

9097d39

more tests

aa20b55

This was referenced May 8, 2025

OSX failure on StringTests.StartsWithNoMatch_StringComparison #112195

Open

System.Net.Mail.Functional.Tests timeout on debug builds #115382

Open

PranavSenthilnathan added 2 commits May 8, 2025 09:38

add IsSupported check

7a0b4c9

Unconditionally compile X509CertificateKeyAccessors

8f44640

vcsjones reviewed May 8, 2025

View reviewed changes

...ryptography/src/System/Security/Cryptography/X509Certificates/X509CertificateKeyAccessors.cs Outdated Show resolved Hide resolved

bartonjs reviewed May 8, 2025

View reviewed changes

.../System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.DSA.cs Outdated Show resolved Hide resolved

bartonjs reviewed May 8, 2025

View reviewed changes

...libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsHash.cs Outdated Show resolved Hide resolved

fix key accessor and PR comments

a577b2a

vcsjones reviewed May 8, 2025

View reviewed changes

bartonjs reviewed May 8, 2025

View reviewed changes

vcsjones reviewed May 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signed CMS for SLH-DSA #115310

Signed CMS for SLH-DSA #115310

PranavSenthilnathan commented May 5, 2025 •

edited

Loading

ghost commented May 5, 2025

ghost commented May 5, 2025

dotnet-policy-service bot commented May 5, 2025

vcsjones commented May 5, 2025

vcsjones commented May 5, 2025

PranavSenthilnathan commented May 7, 2025

vcsjones May 8, 2025 •

edited

Loading

vcsjones May 8, 2025

bartonjs May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

vcsjones May 8, 2025

bartonjs May 8, 2025

bartonjs May 8, 2025

bartonjs May 8, 2025

bartonjs May 8, 2025

bartonjs May 8, 2025

bartonjs May 8, 2025

vcsjones May 8, 2025

bartonjs May 8, 2025

PranavSenthilnathan May 8, 2025

vcsjones May 9, 2025

		@@ -1,4 +1,4 @@
		<Project Sdk="Microsoft.NET.Sdk">
		<Project Sdk="Microsoft.NET.Sdk">

	public static void GetPublicKey()
	public static void GetSlhDsaPublicKey()

	public static void GetPrivateKey()
	public static void GetSlhDsaPrivateKey()

Signed CMS for SLH-DSA #115310

Are you sure you want to change the base?

Signed CMS for SLH-DSA #115310

Conversation

PranavSenthilnathan commented May 5, 2025 • edited Loading

ghost commented May 5, 2025

ghost commented May 5, 2025

dotnet-policy-service bot commented May 5, 2025

vcsjones commented May 5, 2025

vcsjones commented May 5, 2025

PranavSenthilnathan commented May 7, 2025

vcsjones May 8, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

PranavSenthilnathan commented May 5, 2025 •

edited

Loading

vcsjones May 8, 2025 •

edited

Loading