feat(kas): Adds FIPS-203 wrap with ML-KEM-768/1024#3652

Merged

dmihalcik-virtru merged 41 commits into

mainfrom

DSPX-3383-merge-main

Jun 29, 2026

Commits on Jun 16, 2026

feat(policy,crypto): add ML-KEM 768/1024 algorithm support

dmihalcik-virtru
and
claude
committed
feat(crypto): add ML-KEM encryption and decryption

dmihalcik-virtru
and
claude
committed
feat(kas): add ml-kem support to service layer

dmihalcik-virtru
and
claude
committed
feat(kas): extend ml-kem support across service layer

dmihalcik-virtru
and
claude
committed
feat(sdk): add ml-kem algorithm support

dmihalcik-virtru
and
claude
committed
feat(otdfctl,sdk): add ml-kem support to CLI and experimental SDK

dmihalcik-virtru
and
claude
committed
feat(keygen,tests): add ml-kem key generation support

dmihalcik-virtru
and
claude
committed
test(tdf-roundtrips): add ML-KEM-768 and ML-KEM-1024 roundtrip tests

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): adopt X-Wing pattern for ML-KEM implementation

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): remove DecryptWithEphemeralKey from interface and Legacy ML-KEM types

dmihalcik-virtru
and
claude
committed
fix(security): handle StandardMLKEMCrypto in determineKeyType

dmihalcik-virtru
and
claude
committed
perf(security): pre-parse ML-KEM private key in loadKey
dmihalcik-virtru
committed
feat(kasregistry): allow ML-KEM algorithms in ListKeysRequest filter
dmihalcik-virtru
committed
fix(security): export ML-KEM public keys from InProcessProvider

dmihalcik-virtru
and
claude
committed
fix(security): allow pure ML-KEM rewrap through InProcessProvider

dmihalcik-virtru
and
claude
committed
fix(ocrypto): emit canonical PEM block types from ML-KEM encryptors

dmihalcik-virtru
and
claude
committed
test(security): cover missing-kid case in ML-KEM determineKeyType

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): encode pure ML-KEM keys as SPKI/PKCS#8 with NIST OIDs

dmihalcik-virtru
and
claude
committed
feat(sdk): emit mlkem-wrapped type for pure ML-KEM KAOs

dmihalcik-virtru
and
claude
committed
feat(ocrypto): add format auto-detection for ML-KEM public keys

dmihalcik-virtru
and
claude
committed
feat(kas): add mlkem-wrapped case to rewrap handler

dmihalcik-virtru
and
claude
committed
fixup exhaustive nolint lines
dmihalcik-virtru
committed
refactor(ocrypto): unify ML-KEM, X-Wing, and NIST hybrid wrap paths

dmihalcik-virtru
and
claude
committed
fixup remove hkdf from ml-kem pure
dmihalcik-virtru
committed
docs(ocrypto): accept ml-kem direct-key-wrap ADR and refresh stale HKDF references
dmihalcik-virtru
committed

Commits on Jun 22, 2026

Merge main into DSPX-3383-alternative-simplified
dmihalcik-virtru
committed

Commits on Jun 23, 2026

Commits on Jun 24, 2026