Add external mu support to ML-DSA #117966

bartonjs · 2025-07-23T03:13:00Z

dotnet-policy-service · 2025-07-23T03:14:14Z

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

PranavSenthilnathan

comments

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

src/libraries/Common/src/System/Security/Cryptography/MLDsaMuHash.cs

...Common/tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestHelpers.cs

...tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestImplementation.cs

src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_ml_dsa.h

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

...braries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EvpPkey.MLDsa.cs

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

src/libraries/Common/src/System/Security/Cryptography/MLDsaMuHash.cs

...tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestImplementation.cs

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/NetStandardShims.cs

vcsjones · 2025-07-24T01:57:56Z

It looks like NistImportPublicKeyVerifyExternalMu needs to be marked conditional. It's failing on Windows in M.B.C.

 Failed System.Security.Cryptography.Tests.MLDsaImplementationTests.NistImportPublicKeyVerifyExternalMu(testCase: Nist Test Case 152 (ML-DSA-87, ShouldPass: False)) [< 1 ms]
  Error Message:
   System.PlatformNotSupportedException : Operation is not supported on this platform.
  Stack Trace:
     at System.Security.Cryptography.MLDsaImplementation.VerifyExternalMuCore(ReadOnlySpan`1 mu, ReadOnlySpan`1 signature) in E:\code\runtime\src\libraries\Common\src\System\Security\Cryptography\MLDsaImplementation.Windows.cs:line 98
   at System.Security.Cryptography.MLDsa.VerifyExternalMu(ReadOnlySpan`1 mu, ReadOnlySpan`1 signature) in E:\code\runtime\src\libraries\Common\src\System\Security\Cryptography\MLDsa.cs:line 698
   at System.Security.Cryptography.MLDsa.VerifyExternalMu(Byte[] mu, Byte[] signature) in E:\code\runtime\src\libraries\Common\src\System\Security\Cryptography\MLDsa.cs:line 673
   at System.Security.Cryptography.Tests.MLDsaTestsBase.NistImportPublicKeyVerifyExternalMu(MLDsaNistTestCase testCase) in E:\code\runtime\src\libraries\Common\tests\System\Security\Cryptography\AlgorithmImplementations\MLDsa\MLDsaTestsBase.cs:line 298
   at InvokeStub_MLDsaTestsBase.NistImportPublicKeyVerifyExternalMu(Object, Span`1)
   at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) in E:\code\runtime\src\libraries\System.Private.CoreLib\src\System\Reflection\MethodBaseInvoker.cs:line 95

PranavSenthilnathan

some small stuff

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestsBase.cs

src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_ml_dsa.h

Copilot

Pull Request Overview

This PR adds external mu (μ) support to ML-DSA, allowing developers to compute the signature mu value independently and use it for signing and verification operations. This enables more flexible cryptographic workflows where the mu computation can be separated from the actual signing process.

Key changes include:

Addition of SignExternalMu and VerifyExternalMu methods to the ML-DSA API
Introduction of MLDsaMuHash class for stateful mu computation
Native layer support for external mu operations via OpenSSL

Reviewed Changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pal_evp_pkey_ml_dsa.h	Added function declarations for external mu signing and verification
pal_evp_pkey_ml_dsa.c	Implemented external mu signing and verification using OpenSSL EVP APIs
opensslshim.h	Added OSSL_SIGNATURE_PARAM_MU constant definition
entrypoints.c	Exported new external mu functions for P/Invoke
MLDsaOpenSsl.OpenSsl.cs	Added OpenSSL implementation of external mu methods
MLDsaOpenSsl.NotSupported.cs	Added not-supported stubs for external mu methods
MLDsaImplementation.OpenSsl.cs	Added external mu method implementations
System.Security.Cryptography.cs	Added public API surface for external mu functionality
MLDsaMuHash.cs	New class providing stateful hash computation for mu values
MLDsa.cs	Added external mu methods and MLDsaMuHash factory methods
Various test files	Added comprehensive test coverage for external mu functionality
UntouchableStream.cs	Moved common test utility to shared location

src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs

src/libraries/Microsoft.Bcl.Cryptography/src/Resources/Strings.resx

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs

src/libraries/Common/src/System/Security/Cryptography/MLDsaMuHash.cs

PranavSenthilnathan · 2025-07-24T20:49:58Z

Win11 with PQC has test failures on net481. They're all NotImplementedException from Shake256:

src\libraries\Microsoft.Bcl.Cryptography\tests> dn test -f net481

[xUnit.net 00:00:01.06] System.Security.Cryptography.Tests.MLDsaImplementationTests.GenerateSignVerifyEmptyMessageExternalMuWithContext [SKIP]
[xUnit.net 00:00:02.31] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.GenerateSignVerifyExternalMuWithContext [SKIP]
[xUnit.net 00:00:02.52] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.GenerateSignVerifyEmptyMessageExternalMuNoContext [SKIP]
[xUnit.net 00:00:02.52] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.GenerateSignVerifyExternalMuNoContext [SKIP]
[xUnit.net 00:00:03.13] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.NistImportPublicKeyVerifyExternalMu [SKIP]
[xUnit.net 00:00:03.33] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:03.33] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:03.34] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:03.39] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:03.40] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:03.40] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:03.41] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:03.43] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:03.46] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:03.49] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:03.50] System.Security.Cryptography.Tests.AesGcmIsSupportedTests.CtorThrowsPNSEIfNotSupported [SKIP]
[xUnit.net 00:00:03.51] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:03.52] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:03.91] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:03.93] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:03.93] System.Security.Cryptography.Tests.MLDsaImplementationTests.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:04.15] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.GetMLKemPrivateKey_NoPrivateKey [SKIP]
[xUnit.net 00:00:04.16] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.GetMLKemPrivateKey_WithPrivateKey [SKIP]
[xUnit.net 00:00:04.23] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.CheckCopyWithPrivateKey_SlhDsa_OtherSlhDsa [SKIP]
[xUnit.net 00:00:04.23] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.GetMLKemPublicKey_WithPrivateKey [SKIP]
[xUnit.net 00:00:04.23] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.GetSlhDsaPrivateKeyTest [SKIP]
[xUnit.net 00:00:04.24] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.CheckCopyWithPrivateKey_MLKem_OtherMLKem_Seed [SKIP]
[xUnit.net 00:00:04.24] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.CheckCopyWithPrivateKey_MLKem [SKIP]
[xUnit.net 00:00:04.24] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.CheckCopyWithPrivateKey_SlhDsa [SKIP]
[xUnit.net 00:00:04.24] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.CheckCopyWithPrivateKey_MLKem_OtherMLKem_DecapsulationKey [SKIP]
[xUnit.net 00:00:04.25] System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.PrivateKeyAssociationTests.GetSlhDsaPublicKeyTest [SKIP]
[xUnit.net 00:00:04.27] System.Security.Cryptography.X509Certificates.Tests.MLKemCertTests.GetMLKemPublicKey_PlatformNotSupported [SKIP]
[xUnit.net 00:00:04.47] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.GenerateSignVerifyEmptyMessageExternalMuWithContext [SKIP]
[xUnit.net 00:00:04.64] System.Security.Cryptography.Tests.MLDsaImplementationTests.GenerateSignVerifyEmptyMessageExternalMuNoContext [SKIP]
[xUnit.net 00:00:04.75] System.Security.Cryptography.Tests.MLDsaImplementationTests.GenerateSignVerifyExternalMuNoContext [SKIP]
[xUnit.net 00:00:04.94] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:04.95] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:04.95] System.Security.Cryptography.Tests.MLDsaCngTests_AllowExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:05.01] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:05.01] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:05.02] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_ClonesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:05.07] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.GenerateSignVerifyEmptyMessageExternalMuWithContext [SKIP]
[xUnit.net 00:00:05.08] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:05.08] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:05.09] System.Security.Cryptography.Tests.MLDsaImplementationTests.NistImportPublicKeyVerifyExternalMu [SKIP]
[xUnit.net 00:00:05.09] System.Security.Cryptography.Tests.MLDsaImplementationTests.GenerateSignVerifyExternalMuWithContext [SKIP]
[xUnit.net 00:00:05.09] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_AccruesProperly(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:05.17] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-44) [FAIL]
[xUnit.net 00:00:05.18] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-65) [FAIL]
[xUnit.net 00:00:05.18] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.ExternalMuHash_DoesNotKeepMLDsaAlive(algorithm: ML-DSA-87) [FAIL]
[xUnit.net 00:00:05.19] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.GenerateSignVerifyExternalMuWithContext [SKIP]
[xUnit.net 00:00:05.21] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.NistImportPublicKeyVerifyExternalMu [SKIP]
[xUnit.net 00:00:05.21] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.GenerateSignVerifyExternalMuNoContext [SKIP]
[xUnit.net 00:00:05.22] System.Security.Cryptography.Tests.MLDsaCngTests_AllowPlaintextExport.GenerateSignVerifyEmptyMessageExternalMuNoContext [SKIP]

bartonjs · 2025-07-24T22:09:07Z

Win11 with PQC has test failures on net481. They're all NotImplementedException from Shake256:

Fair, guess I get to power that up. In my head it was unreachable until we get to integrate with the Windows feature, but, nope, it's the base impl.

vcsjones

Comments

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

src/libraries/Common/src/System/Security/Cryptography/MLDsaMuHash.cs

...Common/tests/System/Security/Cryptography/AlgorithmImplementations/MLDsa/MLDsaTestHelpers.cs

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs

bartonjs · 2025-07-28T22:21:19Z

Since the API Review session is, at this point, "tomorrow", I've slapped on NO-MERGE so I remind myself to wait for updates from that, rather than getting trigger-happy.

bartonjs · 2025-07-29T22:09:38Z

OK, the latest push

Updates the public API to call the methods Mu and the parameters externalMu.
Leaves the crypto shim and interop stub with the opposite convention.
Removed MLDsaMuHash 🪦.
Adds a test helper that calculates mu (.NET 8+), so we have the crossways SignMu/VerifyData and SignData/VerifyMu checks.
- The helper returns null on netfx, so it skips the crossways checks.
Undoes the move of UntouchableStream, since nothing in this PR requires it to move.

bartonjs · 2025-07-29T22:21:35Z

@artl93 BTW: PQC RC1 API Addition (I was so tempted to say ADD instead of addition...)

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs

bartonjs added 4 commits July 18, 2025 15:34

Shape work

49feaaa

Theoretically working OSSL, Managed

2581e93

Native code for external mu

beb63b1

Lots of tests

57f2674

github-actions bot added the area-System.Security label Jul 23, 2025

dotnet-policy-service bot assigned bartonjs Jul 23, 2025

PranavSenthilnathan reviewed Jul 23, 2025

View reviewed changes

vcsjones reviewed Jul 23, 2025

View reviewed changes

bartonjs added 3 commits July 23, 2025 15:25

Apply feedback, self-review

41892a3

MLDsaTestsBase.ExerciseSuccessfullyVerify should handle null context

42ce1d8

Merge remote-tracking branch 'dotnet/main' into external_mu

3ef2278

This was referenced Jul 24, 2025

[WASM] Hundreds of tests failing without log #117772

Closed

browser-wasm linux Release LibraryTests queues timing out #117974

Open

PranavSenthilnathan reviewed Jul 24, 2025

View reviewed changes

Apply feedback

e4d24f5

bartonjs marked this pull request as ready for review July 24, 2025 19:15

Copilot AI review requested due to automatic review settings July 24, 2025 19:15

Copilot AI reviewed Jul 24, 2025

View reviewed changes

PranavSenthilnathan reviewed Jul 24, 2025

View reviewed changes

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs Outdated Show resolved Hide resolved

PranavSenthilnathan reviewed Jul 24, 2025

View reviewed changes

src/libraries/Common/src/System/Security/Cryptography/MLDsaMuHash.cs Outdated Show resolved Hide resolved

build-analysis bot mentioned this pull request Jul 24, 2025

[Long Running Test] 'System.Composition.UnitTests.ConcurrencyTests.SharedInstancesAreNotVisibleUntilActivationCompletes' #113686

Open

vcsjones reviewed Jul 25, 2025

View reviewed changes

Make Shake256 work on netfx

a46e480

Apply feedback

003abc4

vcsjones reviewed Jul 26, 2025

View reviewed changes

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs Outdated Show resolved Hide resolved

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs Outdated Show resolved Hide resolved

PranavSenthilnathan reviewed Jul 26, 2025

View reviewed changes

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs Outdated Show resolved Hide resolved

PranavSenthilnathan reviewed Jul 26, 2025

View reviewed changes

src/libraries/Microsoft.Bcl.Cryptography/src/System/Security/Cryptography/Shake256.cs Outdated Show resolved Hide resolved

bartonjs added 3 commits July 28, 2025 10:22

Apply feedback

658b533

Merge remote-tracking branch 'dotnet/main' into external_mu

4a7d494

Even more feedback

3fde1a4

PranavSenthilnathan approved these changes Jul 28, 2025

View reviewed changes

bartonjs added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Jul 28, 2025

bartonjs added 2 commits July 29, 2025 14:36

API Review alignment

c2987a6

UntouchableStream doesn't make sense to move in this change

2947049

bartonjs removed the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Jul 29, 2025

Remove unused strings and methods

456a1aa

PranavSenthilnathan approved these changes Jul 29, 2025

View reviewed changes

src/libraries/Common/src/System/Security/Cryptography/MLDsa.cs Outdated Show resolved Hide resolved

build-analysis bot mentioned this pull request Jul 30, 2025

System.Net.Mail.Tests.SmtpClientTlsTest_Send.AuthenticationException_Propagates failure: expected typeof(System.Security.Authentication.AuthenticationException), actual typeof(System.Net.Mail.SmtpException) #117963

Closed

bartonjs added 2 commits July 29, 2025 21:34

Fix whitespace

5c51e29

Merge branch 'main' into external_mu

9a34f67

bartonjs merged commit 73d13d9 into dotnet:main Jul 30, 2025
100 checks passed

bartonjs deleted the external_mu branch July 30, 2025 20:38

github-actions bot locked and limited conversation to collaborators Aug 30, 2025

Add external mu support to ML-DSA #117966

Add external mu support to ML-DSA #117966

Uh oh!

Conversation

bartonjs commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service bot commented Jul 23, 2025

Uh oh!

PranavSenthilnathan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vcsjones commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PranavSenthilnathan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PranavSenthilnathan commented Jul 24, 2025

Uh oh!

bartonjs commented Jul 24, 2025

Uh oh!

vcsjones left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs commented Jul 28, 2025

Uh oh!

bartonjs commented Jul 29, 2025

Uh oh!

bartonjs commented Jul 29, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs commented Jul 23, 2025 •

edited

Loading

vcsjones commented Jul 24, 2025 •

edited

Loading