feat(ssh-key): implement ML-DSA signing and verification

Author: quexten

ssh-key/src/private/mldsa.rs

@@ -196,6 +196,19 @@ fn derive_public<P: ml_dsa::MlDsaParams>(seed: &[u8; SEED_SIZE]) -> Vec<u8> {
     signing_key.verifying_key().encode().as_slice().to_vec()
 }
 
+/// Sign a message with "pure" ML-DSA (empty context) for the concrete parameter set `P`.
+fn sign_with_params<P: ml_dsa::MlDsaParams>(seed: &[u8; SEED_SIZE], msg: &[u8]) -> Result<Vec<u8>> {
+    use signature::Signer;
+
+    let seed = ml_dsa::B32::from(*seed);
+    let signing_key = ml_dsa::SigningKey::<P>::from_seed(&seed);
+
+    // The `Signer` impl uses "pure" ML-DSA with an empty context string, as
+    // required by draft-sfluhrer-ssh-mldsa.
+    let signature = signing_key.try_sign(msg)?;
+    Ok(signature.encode().as_slice().to_vec())
+}
+
 impl MlDsaKeypair {
     /// Generate a random ML-DSA keypair for the given parameter set.
     ///
@@ -224,6 +237,16 @@ impl MlDsaKeypair {
         })
     }
 
+    /// Sign a message, producing the raw ML-DSA signature bytes.
+    pub(crate) fn sign_msg(&self, msg: &[u8]) -> Result<Vec<u8>> {
+        let seed = self.private.as_ref();
+        match self.public.params() {
+            MlDsaParams::MlDsa44 => sign_with_params::<ml_dsa::MlDsa44>(seed, msg),
+            MlDsaParams::MlDsa65 => sign_with_params::<ml_dsa::MlDsa65>(seed, msg),
+            MlDsaParams::MlDsa87 => sign_with_params::<ml_dsa::MlDsa87>(seed, msg),
+        }
+    }
+
     /// Verify that the stored public key matches the key derived from the seed.
     fn validate(&self) -> Result<()> {
         let expected = match self.public.params() {

ssh-key/src/public/mldsa.rs

@@ -4,7 +4,7 @@
 //!
 //! [FIPS204]: https://csrc.nist.gov/pubs/fips/204/final
 
-use crate::{Algorithm, MlDsaParams, Result};
+use crate::{Algorithm, Error, MlDsaParams, Result};
 use alloc::boxed::Box;
 use encoding::{Encode, Reader, Writer};
 use ml_dsa::{EncodedVerifyingKey, MlDsa44, MlDsa65, MlDsa87};
@@ -90,6 +90,19 @@ impl MlDsaPublicKey {
         let key = reader.read_byten(&mut buf)?;
         Self::new(params, key)
     }
+
+    /// Verify a raw ML-DSA signature over the given message using "pure" ML-DSA
+    /// with an empty context string.
+    ///
+    /// # Errors
+    /// Returns [`Error::Signature`] if the signature is malformed or invalid.
+    pub(crate) fn verify_msg(&self, msg: &[u8], signature: &[u8]) -> Result<()> {
+        match self {
+            Self::MlDsa44(key) => verify_with_params::<MlDsa44>(key, msg, signature),
+            Self::MlDsa65(key) => verify_with_params::<MlDsa65>(key, msg, signature),
+            Self::MlDsa87(key) => verify_with_params::<MlDsa87>(key, msg, signature),
+        }
+    }
 }
 
 impl AsRef<[u8]> for MlDsaPublicKey {
@@ -107,3 +120,21 @@ impl Encode for MlDsaPublicKey {
         self.as_bytes().encode(writer)
     }
 }
+
+/// Verify an ML-DSA signature over `msg` with the concrete ML-DSA parameter set `P`.
+fn verify_with_params<P: ml_dsa::MlDsaParams>(
+    key: &EncodedVerifyingKey<P>,
+    msg: &[u8],
+    signature: &[u8],
+) -> Result<()> {
+    use signature::Verifier;
+
+    let verifying_key = ml_dsa::VerifyingKey::<P>::decode(key);
+    let signature = ml_dsa::Signature::<P>::try_from(signature).map_err(|_| Error::Signature)?;
+
+    // The `Verifier` impl uses "pure" ML-DSA with an empty context string, as
+    // required by draft-sfluhrer-ssh-mldsa.
+    verifying_key
+        .verify(msg, &signature)
+        .map_err(|_| Error::Signature)
+}

ssh-key/src/signature.rs

@@ -9,6 +9,9 @@ use signature::{SignatureEncoding, Signer, Verifier};
 #[cfg(feature = "ed25519")]
 use crate::{private::Ed25519Keypair, public::Ed25519PublicKey};
 
+#[cfg(feature = "mldsa")]
+use crate::{private::MlDsaKeypair, public::MlDsaPublicKey};
+
 #[cfg(feature = "dsa")]
 use {
     crate::{private::DsaKeypair, public::DsaPublicKey},
@@ -112,6 +115,7 @@ impl Signature {
             Algorithm::SkEd25519 if data.len() == SK_ED25519_SIGNATURE_SIZE => (),
             Algorithm::SkEcdsaSha2NistP256 => ecdsa_sig_size(&data, EcdsaCurve::NistP256, true)?,
             Algorithm::Rsa { .. } => (),
+            Algorithm::MlDsa { params } if data.len() == params.signature_size() => (),
             Algorithm::Other(_) if !data.is_empty() => (),
             _ => return Err(encoding::Error::Length.into()),
         }
@@ -293,6 +297,8 @@ impl Signer<Signature> for private::KeypairData {
             Self::Ed25519(keypair) => keypair.try_sign(message),
             #[cfg(feature = "rsa")]
             Self::Rsa(keypair) => keypair.try_sign(message),
+            #[cfg(feature = "mldsa")]
+            Self::MlDsa(keypair) => keypair.try_sign(message),
             _ => Err(self.algorithm()?.unsupported_error().into()),
         }
     }
@@ -320,6 +326,8 @@ impl Verifier<Signature> for public::KeyData {
             Self::SkEcdsaSha2NistP256(pk) => pk.verify(message, signature),
             #[cfg(feature = "rsa")]
             Self::Rsa(pk) => pk.verify(message, signature),
+            #[cfg(feature = "mldsa")]
+            Self::MlDsa(pk) => pk.verify(message, signature),
             #[allow(unreachable_patterns)]
             _ => Err(self.algorithm().unsupported_error().into()),
         }
@@ -452,6 +460,30 @@ impl Verifier<Signature> for Ed25519PublicKey {
     }
 }
 
+#[cfg(feature = "mldsa")]
+impl Signer<Signature> for MlDsaKeypair {
+    fn try_sign(&self, message: &[u8]) -> signature::Result<Signature> {
+        let data = self.sign_msg(message)?;
+
+        Ok(Signature {
+            algorithm: self.algorithm(),
+            data,
+        })
+    }
+}
+
+#[cfg(feature = "mldsa")]
+impl Verifier<Signature> for MlDsaPublicKey {
+    fn verify(&self, message: &[u8], signature: &Signature) -> signature::Result<()> {
+        // The signature's algorithm (including parameter set) must match this key.
+        if signature.algorithm() != self.algorithm() {
+            return Err(Error::Signature.into());
+        }
+
+        Ok(self.verify_msg(message, signature.as_bytes())?)
+    }
+}
+
 #[cfg(feature = "ed25519")]
 impl Verifier<Signature> for public::SkEd25519 {
     fn verify(&self, message: &[u8], signature: &Signature) -> signature::Result<()> {
@@ -767,10 +799,19 @@ mod tests {
     use encoding::Encode;
     use hex_literal::hex;
 
-    #[cfg(any(feature = "ed25519", all(feature = "rsa", feature = "sha1")))]
-    use signature::Verifier;
     #[cfg(feature = "ed25519")]
-    use {super::Ed25519Keypair, signature::Signer};
+    use super::Ed25519Keypair;
+    #[cfg(any(feature = "ed25519", feature = "mldsa"))]
+    use signature::Signer;
+    #[cfg(any(
+        feature = "ed25519",
+        feature = "mldsa",
+        all(feature = "rsa", feature = "sha1")
+    ))]
+    use signature::Verifier;
+
+    #[cfg(feature = "mldsa")]
+    use {super::MlDsaKeypair, crate::MlDsaParams};
 
     #[cfg(feature = "p256")]
     use super::{Mpint, zero_pad_field_bytes};
@@ -922,7 +963,6 @@ mod tests {
     fn try_sign_and_verify_dsa() {
         use super::{DSA_COMPONENT_SIZE, DsaKeypair};
         use encoding::Decode as _;
-        use signature::{Signer as _, Verifier as _};
 
         fn check_signature_component_lengths(
             keypair: &DsaKeypair,
@@ -1001,6 +1041,59 @@ mod tests {
         assert!(keypair.public.verify(EXAMPLE_MSG, &signature).is_ok());
     }
 
+    #[cfg(feature = "mldsa")]
+    #[test]
+    fn sign_and_verify_mldsa() {
+        let msg = b"Hello, world!";
+
+        for params in [
+            MlDsaParams::MlDsa44,
+            MlDsaParams::MlDsa65,
+            MlDsaParams::MlDsa87,
+        ] {
+            let keypair = MlDsaKeypair::from_seed(params, &[42; 32]).unwrap();
+            let signature = keypair.sign(msg);
+
+            assert_eq!(signature.algorithm(), Algorithm::MlDsa { params });
+            assert_eq!(signature.as_bytes().len(), params.signature_size());
+            assert!(keypair.public.verify(msg, &signature).is_ok());
+
+            // Signing is deterministic (empty context, deterministic variant).
+            assert_eq!(keypair.sign(msg), signature);
+
+            // A tampered message must fail verification.
+            assert!(keypair.public.verify(b"tampered", &signature).is_err());
+
+            // Signature encode/decode round-trips.
+            let encoded = signature.encode_vec().unwrap();
+            let decoded = Signature::try_from(&encoded[..]).unwrap();
+            assert_eq!(decoded, signature);
+        }
+    }
+
+    #[cfg(feature = "mldsa")]
+    #[test]
+    fn mldsa_key_roundtrip() {
+        use crate::{private::KeypairData, public::KeyData};
+        use encoding::Decode;
+
+        let params = MlDsaParams::MlDsa65;
+        let keypair = MlDsaKeypair::from_seed(params, &[7; 32]).unwrap();
+
+        // Public key wire-format round-trips and reports the correct algorithm.
+        let public: KeyData = keypair.public.clone().into();
+        let encoded = public.encode_vec().unwrap();
+        let decoded = KeyData::decode(&mut &encoded[..]).unwrap();
+        assert_eq!(decoded, public);
+        assert_eq!(decoded.algorithm(), Algorithm::MlDsa { params });
+
+        // Keypair wire-format round-trips.
+        let keypair_data = KeypairData::from(keypair);
+        let encoded = keypair_data.encode_vec().unwrap();
+        let decoded = KeypairData::decode(&mut &encoded[..]).unwrap();
+        assert_eq!(decoded, keypair_data);
+    }
+
     #[test]
     fn placeholder() {
         assert!(