feat(ssh-key): add ML-DSA private key and keypair types

Author: quexten

ssh-key/src/private.rs

@@ -100,6 +100,8 @@ mod ecdsa;
 mod ed25519;
 mod keypair;
 #[cfg(feature = "alloc")]
+mod mldsa;
+#[cfg(feature = "alloc")]
 mod opaque;
 #[cfg(feature = "alloc")]
 mod rsa;
@@ -116,6 +118,7 @@ pub use crate::{
     Comment, SshSig,
     private::{
         dsa::{DsaKeypair, DsaPrivateKey},
+        mldsa::{MlDsaKeypair, MlDsaPrivateKey},
         opaque::{OpaqueKeypair, OpaqueKeypairBytes, OpaquePrivateKeyBytes},
         rsa::{RsaKeypair, RsaPrivateKey},
         sk::SkEd25519,
@@ -622,6 +625,8 @@ impl PrivateKey {
             Algorithm::Rsa { .. } => {
                 KeypairData::from(RsaKeypair::random(rng, DEFAULT_RSA_KEY_SIZE)?)
             }
+            #[cfg(feature = "mldsa")]
+            Algorithm::MlDsa { params } => KeypairData::from(MlDsaKeypair::random(rng, params)?),
             _ => return Err(Error::AlgorithmUnknown),
         };
         let public_key = public::KeyData::try_from(&key_data)?;
@@ -1002,6 +1007,15 @@ impl From<RsaKeypair> for PrivateKey {
     }
 }
 
+#[cfg(feature = "alloc")]
+impl From<MlDsaKeypair> for PrivateKey {
+    fn from(keypair: MlDsaKeypair) -> PrivateKey {
+        KeypairData::from(keypair)
+            .try_into()
+            .expect(CONVERSION_ERROR_MSG)
+    }
+}
+
 #[cfg(all(feature = "alloc", feature = "ecdsa"))]
 impl From<SkEcdsaSha2NistP256> for PrivateKey {
     fn from(keypair: SkEcdsaSha2NistP256) -> PrivateKey {

ssh-key/src/private/keypair.rs

@@ -7,7 +7,7 @@ use encoding::{CheckedSum, Decode, Encode, Reader, Writer};
 
 #[cfg(feature = "alloc")]
 use {
-    super::{DsaKeypair, OpaqueKeypair, RsaKeypair, SkEd25519},
+    super::{DsaKeypair, MlDsaKeypair, OpaqueKeypair, RsaKeypair, SkEd25519},
     alloc::vec::Vec,
 };
 
@@ -44,6 +44,10 @@ pub enum KeypairData {
     #[cfg(feature = "alloc")]
     Rsa(RsaKeypair),
 
+    /// ML-DSA keypair
+    #[cfg(feature = "alloc")]
+    MlDsa(MlDsaKeypair),
+
     /// Security Key (FIDO/U2F) using ECDSA/NIST P-256 as specified in [PROTOCOL.u2f].
     ///
     /// [PROTOCOL.u2f]: https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.u2f?annotate=HEAD
@@ -77,6 +81,8 @@ impl KeypairData {
             Self::Encrypted(_) => return Err(Error::Encrypted),
             #[cfg(feature = "alloc")]
             Self::Rsa(_) => Algorithm::Rsa { hash: None },
+            #[cfg(feature = "alloc")]
+            Self::MlDsa(key) => key.algorithm(),
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             Self::SkEcdsaSha2NistP256(_) => Algorithm::SkEcdsaSha2NistP256,
             #[cfg(feature = "alloc")]
@@ -136,6 +142,16 @@ impl KeypairData {
         }
     }
 
+    /// Get ML-DSA keypair if this key is the correct type.
+    #[cfg(feature = "alloc")]
+    #[must_use]
+    pub fn mldsa(&self) -> Option<&MlDsaKeypair> {
+        match self {
+            Self::MlDsa(key) => Some(key),
+            _ => None,
+        }
+    }
+
     /// Get FIDO/U2F ECDSA/NIST P-256 private key if this key is the correct type.
     #[cfg(all(feature = "alloc", feature = "ecdsa"))]
     #[must_use]
@@ -207,6 +223,13 @@ impl KeypairData {
         matches!(self, Self::Rsa(_))
     }
 
+    /// Is this key an ML-DSA key?
+    #[cfg(feature = "alloc")]
+    #[must_use]
+    pub fn is_mldsa(&self) -> bool {
+        matches!(self, Self::MlDsa(_))
+    }
+
     /// Is this key a FIDO/U2F ECDSA/NIST P-256 key?
     #[cfg(all(feature = "alloc", feature = "ecdsa"))]
     #[must_use]
@@ -243,6 +266,8 @@ impl KeypairData {
             Self::Encrypted(ciphertext) => ciphertext.as_ref(),
             #[cfg(feature = "alloc")]
             Self::Rsa(rsa) => rsa.private().d().as_bytes(),
+            #[cfg(feature = "alloc")]
+            Self::MlDsa(mldsa) => mldsa.private.as_ref(),
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             Self::SkEcdsaSha2NistP256(sk) => sk.key_handle(),
             #[cfg(feature = "alloc")]
@@ -278,6 +303,8 @@ impl KeypairData {
             Algorithm::Ed25519 => Ed25519Keypair::decode(reader).map(Self::Ed25519),
             #[cfg(feature = "alloc")]
             Algorithm::Rsa { .. } => RsaKeypair::decode(reader).map(Self::Rsa),
+            #[cfg(feature = "alloc")]
+            Algorithm::MlDsa { params } => MlDsaKeypair::decode_as(reader, params).map(Self::MlDsa),
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             Algorithm::SkEcdsaSha2NistP256 => {
                 SkEcdsaSha2NistP256::decode(reader).map(Self::SkEcdsaSha2NistP256)
@@ -307,6 +334,8 @@ impl CtEq for KeypairData {
             (Self::Encrypted(a), Self::Encrypted(b)) => a.ct_eq(b),
             #[cfg(feature = "alloc")]
             (Self::Rsa(a), Self::Rsa(b)) => a.ct_eq(b),
+            #[cfg(feature = "alloc")]
+            (Self::MlDsa(a), Self::MlDsa(b)) => a.ct_eq(b),
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             (Self::SkEcdsaSha2NistP256(a), Self::SkEcdsaSha2NistP256(b)) => {
                 // Security Keys store the actual private key in hardware.
@@ -363,6 +392,8 @@ impl Encode for KeypairData {
             Self::Encrypted(ciphertext) => return Ok(ciphertext.len()),
             #[cfg(feature = "alloc")]
             Self::Rsa(key) => key.encoded_len()?,
+            #[cfg(feature = "alloc")]
+            Self::MlDsa(key) => key.encoded_len()?,
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             Self::SkEcdsaSha2NistP256(sk) => sk.encoded_len()?,
             #[cfg(feature = "alloc")]
@@ -389,6 +420,8 @@ impl Encode for KeypairData {
             Self::Encrypted(ciphertext) => writer.write(ciphertext)?,
             #[cfg(feature = "alloc")]
             Self::Rsa(key) => key.encode(writer)?,
+            #[cfg(feature = "alloc")]
+            Self::MlDsa(key) => key.encode(writer)?,
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             Self::SkEcdsaSha2NistP256(sk) => sk.encode(writer)?,
             #[cfg(feature = "alloc")]
@@ -415,6 +448,8 @@ impl TryFrom<&KeypairData> for public::KeyData {
             KeypairData::Encrypted(_) => return Err(Error::Encrypted),
             #[cfg(feature = "alloc")]
             KeypairData::Rsa(rsa) => public::KeyData::Rsa(rsa.into()),
+            #[cfg(feature = "alloc")]
+            KeypairData::MlDsa(mldsa) => public::KeyData::MlDsa(mldsa.into()),
             #[cfg(all(feature = "alloc", feature = "ecdsa"))]
             KeypairData::SkEcdsaSha2NistP256(sk) => {
                 public::KeyData::SkEcdsaSha2NistP256(sk.public().clone())
@@ -454,6 +489,13 @@ impl From<RsaKeypair> for KeypairData {
     }
 }
 
+#[cfg(feature = "alloc")]
+impl From<MlDsaKeypair> for KeypairData {
+    fn from(keypair: MlDsaKeypair) -> KeypairData {
+        Self::MlDsa(keypair)
+    }
+}
+
 #[cfg(all(feature = "alloc", feature = "ecdsa"))]
 impl From<SkEcdsaSha2NistP256> for KeypairData {
     fn from(keypair: SkEcdsaSha2NistP256) -> KeypairData {