mtpki: use ML-DSA (#8803)

genmtpki now outputs a ML-DSA certificate and private key.

Our various loading functions had some type switches that accounted for
RSA and ECDSA, but errored on ML-DSA keys. Factored out those functions
into versions for go1.27 and for !go1.27.

As a quality of life improvement, add a `-output-dir` flag for genmtpki
to allow writing it in different places while iterating.

Fixes #8787

Author: jsha

cmd/boulder-ca/main.go

@@ -194,7 +194,7 @@ func main() {
 		}
 
 		issuer, err := issuance.LoadIssuer(issuerConfig, clk)
-		cmd.FailOnError(err, "Loading issuer")
+		cmd.FailOnError(err, fmt.Sprintf("Loading issuer %q", issuerConfig.Location.CertFile))
 		issuers = append(issuers, issuer)
 	}
 

issuance/issuer.go

@@ -2,9 +2,6 @@ package issuance
 
 import (
 	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/json"
 	"errors"
@@ -209,24 +206,9 @@ type Issuer struct {
 // newIssuer constructs a new Issuer from the in-memory certificate and signer.
 // It exists as a helper for LoadIssuer to make testing simpler.
 func newIssuer(config IssuerConfig, cert *Certificate, signer crypto.Signer, clk clock.Clock) (*Issuer, error) {
-	var keyAlg x509.PublicKeyAlgorithm
-	var sigAlg x509.SignatureAlgorithm
-	switch k := cert.PublicKey.(type) {
-	case *rsa.PublicKey:
-		keyAlg = x509.RSA
-		sigAlg = x509.SHA256WithRSA
-	case *ecdsa.PublicKey:
-		keyAlg = x509.ECDSA
-		switch k.Curve {
-		case elliptic.P256():
-			sigAlg = x509.ECDSAWithSHA256
-		case elliptic.P384():
-			sigAlg = x509.ECDSAWithSHA384
-		default:
-			return nil, fmt.Errorf("unsupported ECDSA curve: %q", k.Curve.Params().Name)
-		}
-	default:
-		return nil, errors.New("unsupported issuer key type")
+	keyAlg, sigAlg, err := pubkeyParams(cert.PublicKey)
+	if err != nil {
+		return nil, err
 	}
 
 	if config.IssuerURL == "" {
@@ -274,8 +256,8 @@ func newIssuer(config IssuerConfig, cert *Certificate, signer crypto.Signer, clk
 	return i, nil
 }
 
-// KeyType returns either x509.RSA or x509.ECDSA, depending on whether the
-// issuer has an RSA or ECDSA keypair. This is useful for determining which
+// KeyType returns x509.RSA, x509.ECDSA, or x509.MLDSA depending on the
+// keypair of the issuer. This is useful for determining which
 // issuance requests should be routed to this issuer.
 func (i *Issuer) KeyType() x509.PublicKeyAlgorithm {
 	return i.keyAlg

issuance/pubkeyparams.go

@@ -0,0 +1,32 @@
+//go:build !go1.27
+
+package issuance
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"errors"
+	"fmt"
+)
+
+func pubkeyParams(pubkey any) (x509.PublicKeyAlgorithm, x509.SignatureAlgorithm, error) {
+	switch k := pubkey.(type) {
+	case *rsa.PublicKey:
+		return x509.RSA, x509.SHA256WithRSA, nil
+	case *ecdsa.PublicKey:
+		switch k.Curve {
+		case elliptic.P256():
+			return x509.ECDSA, x509.ECDSAWithSHA256, nil
+		case elliptic.P384():
+			return x509.ECDSA, x509.ECDSAWithSHA384, nil
+		default:
+			return x509.UnknownPublicKeyAlgorithm, x509.UnknownSignatureAlgorithm,
+				fmt.Errorf("unsupported ECDSA curve: %q", k.Curve.Params().Name)
+		}
+	default:
+		return x509.UnknownPublicKeyAlgorithm, x509.UnknownSignatureAlgorithm,
+			errors.New("unsupported issuer key type")
+	}
+}

issuance/pubkeyparams_go127.go

@@ -0,0 +1,37 @@
+//go:build go1.27
+
+package issuance
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/mldsa"
+	"crypto/rsa"
+	"crypto/x509"
+	"errors"
+	"fmt"
+)
+
+// pubkeyParams returns a PublicKeyAlgorithm and SignatureAlgorithm for the input pubkey.
+// TODO(#8812): Move this back to issuer.go.
+func pubkeyParams(pubkey any) (x509.PublicKeyAlgorithm, x509.SignatureAlgorithm, error) {
+	switch k := pubkey.(type) {
+	case *mldsa.PublicKey:
+		return x509.MLDSA, x509.MLDSA44, nil
+	case *rsa.PublicKey:
+		return x509.RSA, x509.SHA256WithRSA, nil
+	case *ecdsa.PublicKey:
+		switch k.Curve {
+		case elliptic.P256():
+			return x509.ECDSA, x509.ECDSAWithSHA256, nil
+		case elliptic.P384():
+			return x509.ECDSA, x509.ECDSAWithSHA384, nil
+		default:
+			return x509.UnknownPublicKeyAlgorithm, x509.UnknownSignatureAlgorithm,
+				fmt.Errorf("unsupported ECDSA curve: %q", k.Curve.Params().Name)
+		}
+	default:
+		return x509.UnknownPublicKeyAlgorithm, x509.UnknownSignatureAlgorithm,
+			errors.New("unsupported issuer key type")
+	}
+}

linter/linter.go

@@ -3,9 +3,7 @@ package linter
 import (
 	"bytes"
 	"crypto"
-	"crypto/ecdsa"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"fmt"
 	"strings"
@@ -136,26 +134,6 @@ func (l *Linter) CheckCRL(tbs *x509.RevocationList, reg lint.Registry) error {
 	return ProcessResultSet(lintRes)
 }
 
-func makeSigner(realSigner crypto.Signer) (crypto.Signer, error) {
-	var lintSigner crypto.Signer
-	var err error
-	switch k := realSigner.Public().(type) {
-	case *rsa.PublicKey:
-		lintSigner, err = rsa.GenerateKey(rand.Reader, k.Size()*8)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create RSA lint signer: %w", err)
-		}
-	case *ecdsa.PublicKey:
-		lintSigner, err = ecdsa.GenerateKey(k.Curve, rand.Reader)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create ECDSA lint signer: %w", err)
-		}
-	default:
-		return nil, fmt.Errorf("unsupported lint signer type: %T", k)
-	}
-	return lintSigner, nil
-}
-
 func makeIssuer(realIssuer *x509.Certificate, lintSigner crypto.Signer) (*x509.Certificate, error) {
 	lintIssuerTBS := &x509.Certificate{
 		// This is nearly the full list of attributes that

linter/makesigner.go

@@ -0,0 +1,31 @@
+//go:build !go1.27
+
+package linter
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+)
+
+func makeSigner(realSigner crypto.Signer) (crypto.Signer, error) {
+	var lintSigner crypto.Signer
+	var err error
+	switch k := realSigner.Public().(type) {
+	case *rsa.PublicKey:
+		lintSigner, err = rsa.GenerateKey(rand.Reader, k.Size()*8)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create RSA lint signer: %w", err)
+		}
+	case *ecdsa.PublicKey:
+		lintSigner, err = ecdsa.GenerateKey(k.Curve, rand.Reader)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create ECDSA lint signer: %w", err)
+		}
+	default:
+		return nil, fmt.Errorf("unsupported lint signer type: %T", k)
+	}
+	return lintSigner, nil
+}

linter/makesigner_go127.go

@@ -0,0 +1,40 @@
+//go:build go1.27
+
+package linter
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/mldsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+)
+
+// makeSigner makes a signer with a throwaway key that matches `realSigner`'s type.
+//
+// TODO(#8812): Move this back to linter.go, above makeIssuer.
+func makeSigner(realSigner crypto.Signer) (crypto.Signer, error) {
+	var lintSigner crypto.Signer
+	var err error
+	switch k := realSigner.Public().(type) {
+	case *rsa.PublicKey:
+		lintSigner, err = rsa.GenerateKey(rand.Reader, k.Size()*8)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create RSA lint signer: %w", err)
+		}
+	case *ecdsa.PublicKey:
+		lintSigner, err = ecdsa.GenerateKey(k.Curve, rand.Reader)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create ECDSA lint signer: %w", err)
+		}
+	case *mldsa.PublicKey:
+		lintSigner, err = mldsa.GenerateKey(k.Parameters())
+		if err != nil {
+			return nil, fmt.Errorf("failed to create ML-DSA lint signer: %w", err)
+		}
+	default:
+		return nil, fmt.Errorf("unsupported lint signer type: %T", k)
+	}
+	return lintSigner, nil
+}

privatekey/privatekey.go

@@ -57,29 +57,6 @@ func verifyECDSA(privKey *ecdsa.PrivateKey, pubKey *ecdsa.PublicKey, msgHash has
 	return privKey, privKey.Public(), nil
 }
 
-// verify ensures that the embedded PublicKey of the provided privateKey is
-// actually a match for the private key. For an example of private keys
-// embedding a mismatched public key, see:
-// https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html.
-func verify(privateKey crypto.Signer) (crypto.Signer, crypto.PublicKey, error) {
-	verifyHash, err := makeVerifyHash()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	switch k := privateKey.(type) {
-	case *rsa.PrivateKey:
-		return verifyRSA(k, &k.PublicKey, verifyHash)
-
-	case *ecdsa.PrivateKey:
-		return verifyECDSA(k, &k.PublicKey, verifyHash)
-
-	default:
-		// This should never happen.
-		return nil, nil, errors.New("the provided private key could not be asserted to ECDSA or RSA")
-	}
-}
-
 // Load decodes and parses a private key from the provided file path and returns
 // the private key as crypto.Signer. keyPath is expected to be a PEM formatted
 // RSA or ECDSA private key in a PKCS #1, PKCS# 8, or SEC 1 container. The

privatekey/verify.go

@@ -0,0 +1,33 @@
+//go:build !go1.27
+
+package privatekey
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"errors"
+)
+
+// verify ensures that the embedded PublicKey of the provided privateKey is
+// actually a match for the private key. For an example of private keys
+// embedding a mismatched public key, see:
+// https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html.
+func verify(privateKey crypto.Signer) (crypto.Signer, crypto.PublicKey, error) {
+	verifyHash, err := makeVerifyHash()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	switch k := privateKey.(type) {
+	case *rsa.PrivateKey:
+		return verifyRSA(k, &k.PublicKey, verifyHash)
+
+	case *ecdsa.PrivateKey:
+		return verifyECDSA(k, &k.PublicKey, verifyHash)
+
+	default:
+		// This should never happen.
+		return nil, nil, errors.New("the provided private key could not be asserted to ECDSA or RSA")
+	}
+}

privatekey/verify_go127.go

@@ -0,0 +1,55 @@
+//go:build go1.27
+
+package privatekey
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/mldsa"
+	"crypto/rsa"
+	"errors"
+	"fmt"
+	"hash"
+)
+
+// verify ensures that the embedded PublicKey of the provided privateKey is
+// actually a match for the private key. For an example of private keys
+// embedding a mismatched public key, see:
+// https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html.
+//
+// TODO(#8812): move this back to privatekey.go, above Load().
+func verify(privateKey crypto.Signer) (crypto.Signer, crypto.PublicKey, error) {
+	verifyHash, err := makeVerifyHash()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	switch k := privateKey.(type) {
+	case *rsa.PrivateKey:
+		return verifyRSA(k, &k.PublicKey, verifyHash)
+
+	case *ecdsa.PrivateKey:
+		return verifyECDSA(k, &k.PublicKey, verifyHash)
+
+	case *mldsa.PrivateKey:
+		return verifyMLDSA(k, k.PublicKey(), verifyHash)
+
+	default:
+		// This should never happen.
+		return nil, nil, errors.New("the provided private key was not *rsa.PrivateKey, *ecdsa.PrivateKey, or *mldsa.PrivateKey")
+	}
+}
+
+// verifyMLDSA verifies ML-DSA private keys.
+func verifyMLDSA(privKey *mldsa.PrivateKey, pubKey *mldsa.PublicKey, msgHash hash.Hash) (crypto.Signer, crypto.PublicKey, error) {
+	sig, err := privKey.Sign(nil, msgHash.Sum(nil), nil)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to sign using the provided ML-DSA private key: %s", err)
+	}
+
+	err = mldsa.Verify(pubKey, msgHash.Sum(nil), sig, nil)
+	if err != nil {
+		return nil, nil, fmt.Errorf("the provided ML-DSA private key failed signature verification: %s", err)
+	}
+	return privKey, privKey.Public(), nil
+}