Add generating Chimera certs#182
Conversation
|
Can one of the admins verify this patch? |
|
Ok to test Jenkins |
|
The FIPS CI failure is due to more restrictive algorithms now. Removing the use of DES and causing decryption of DES encrypted keys to fail. This PR (#183) adjusts the test cases to account for that. |
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for generating Chimera certificates, which implement dual-algorithm cryptography combining traditional ECC with post-quantum ML-DSA signatures. The implementation includes new command-line options, key generation functionality for ML-DSA, and a comprehensive certificate generation function that creates certificates with dual cryptographic signatures.
- Adds ML-DSA key generation capabilities alongside existing Dilithium support
- Implements Chimera certificate generation with dual ECC/ML-DSA signatures
- Extends CA setup with new command-line options for alternate keys and extended signing modes
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfclu/x509/clu_x509_sign.h | Adds function declaration for Chimera certificate generation |
| wolfclu/genkey/clu_genkey.h | Adds ML-DSA key generation function declaration with documentation |
| wolfclu/clu_optargs.h | Defines new command-line option constants for alternate keys and extended signing |
| tests/x509/expect-purpose.txt | Updates test expectation for TLS Web Client Authentication |
| src/x509/clu_x509_sign.c | Implements comprehensive Chimera certificate generation function |
| src/x509/clu_ca_setup.c | Extends CA setup with new options and alternate signing workflow |
| src/tools/clu_funcs.c | Adds ML-DSA to help documentation |
| src/genkey/clu_genkey_setup.c | Adds ML-DSA key generation setup and argument parsing |
| src/genkey/clu_genkey.c | Implements ML-DSA key generation functionality |
| README.md | Documents Chimera certificate creation workflow with examples |
|
@Yu-Ma28051503 please assign to wolfSSL-bot or ping me on slack when ready for a re-review. |
JacobBarthelmeh
left a comment
JacobBarthelmeh
left a comment
There was a problem hiding this comment.
Thanks for adding the test cases! Please resolve the CI reports.
The following items have not yet been implemented,