authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2024-09-18 08:47:05+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-09-24 13:18:32-07:00
logc062c532d7b09b4a593328c486f7fcad70886062
tree5f5b1a3cc5a3251d4f9eee57f95b1533fcfeef9c
parentd3ba5f397d3270047bcf05c7ed21c5bd6b97e75b

Add post-quantum key agreement X25519MLKEM768

X25519MLKEM768 replaces X25519Kyber768Draft00 now that NIST has released ML-KEM. IANA has assigned the codepoint 0x11ec: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8

2 files changed, 9 insertions(+), 9 deletions(-)

lib/std/crypto/tls.zig+2-2
......@@ -279,8 +279,8 @@ pub const NamedGroup = enum(u16) {
279279 ffdhe8192 = 0x0104,
280280
281281 // Hybrid post-quantum key agreements
282 x25519_kyber512d00 = 0xFE30,
283 x25519_kyber768d00 = 0x6399,
282 secp256r1_ml_kem256 = 0x11EB,
283 x25519_ml_kem768 = 0x11EC,
284284
285285 _,
286286};
lib/std/crypto/tls/Client.zig+7-7
......@@ -158,7 +158,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) In
158158 // Only possible to happen if the private key is all zeroes.
159159 error.IdentityElement => return error.InsufficientEntropy,
160160 };
161 const kyber768_kp = crypto.kem.kyber_d00.Kyber768.KeyPair.create(null) catch {};
161 const ml_kem768_kp = crypto.kem.ml_kem.MLKem768.KeyPair.create(null) catch {};
162162
163163 const extensions_payload =
164164 tls.extension(.supported_versions, [_]u8{
......@@ -172,7 +172,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) In
172172 .rsa_pss_rsae_sha512,
173173 .ed25519,
174174 })) ++ tls.extension(.supported_groups, enum_array(tls.NamedGroup, &.{
175 .x25519_kyber768d00,
175 .x25519_ml_kem768,
176176 .secp256r1,
177177 .x25519,
178178 })) ++ tls.extension(
......@@ -181,8 +181,8 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) In
181181 array(1, x25519_kp.public_key) ++
182182 int2(@intFromEnum(tls.NamedGroup.secp256r1)) ++
183183 array(1, secp256r1_kp.public_key.toUncompressedSec1()) ++
184 int2(@intFromEnum(tls.NamedGroup.x25519_kyber768d00)) ++
185 array(1, x25519_kp.public_key ++ kyber768_kp.public_key.toBytes())),
184 int2(@intFromEnum(tls.NamedGroup.x25519_ml_kem768)) ++
185 array(1, x25519_kp.public_key ++ ml_kem768_kp.public_key.toBytes())),
186186 ) ++
187187 int2(@intFromEnum(tls.ExtensionType.server_name)) ++
188188 int2(host_len + 5) ++ // byte length of this extension payload
......@@ -298,9 +298,9 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) In
298298 const key_size = extd.decode(u16);
299299 try extd.ensure(key_size);
300300 switch (named_group) {
301 .x25519_kyber768d00 => {
301 .x25519_ml_kem768 => {
302302 const xksl = crypto.dh.X25519.public_length;
303 const hksl = xksl + crypto.kem.kyber_d00.Kyber768.ciphertext_length;
303 const hksl = xksl + crypto.kem.ml_kem.MLKem768.ciphertext_length;
304304 if (key_size != hksl)
305305 return error.TlsIllegalParameter;
306306 const server_ks = extd.array(hksl);
......@@ -308,7 +308,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) In
308308 shared_key = &((crypto.dh.X25519.scalarmult(
309309 x25519_kp.secret_key,
310310 server_ks[0..xksl].*,
311 ) catch return error.TlsDecryptFailure) ++ (kyber768_kp.secret_key.decaps(
311 ) catch return error.TlsDecryptFailure) ++ (ml_kem768_kp.secret_key.decaps(
312312 server_ks[xksl..hksl],
313313 ) catch return error.TlsDecryptFailure));
314314 },