MLKEM public keys in CertificatePublicKeyTypes

[PimvanderEijk]

In the definition of CertificatePublicKeyTypes there is a comment

"x448/x25519 can be a public key but cannot be used in signing so they are allowed here."

But the same is true for the MLKEM768PublicKey, MLKEM1024PublicKey, should they be added too?

cryptography/src/cryptography/hazmat/primitives/asymmetric/types.py

Line 80 in ba48f7f

CertificatePublicKeyTypes = typing.Union[

[alex]

Probably! I'd need to spend a second thinking if there's a reason that this true for ML-KEM, but prima facie this seems like a thing we'd be happy for a PR on.

[ronaldvanrij]

I just ran into the same and researched it a bit. I'll share my findings below:

ML-KEM can be used TLS Key Agreement either as the pure variant or as component in Hybrid Key Agreement. However it can also used to encrypt data or encryption keys, as opposed to using ML-DSA, which is for digital signatures.

As an example, this is referenced in the S/MIME Baseline Requirements. Section 6.1.5 and Section 6.1.6 allow ML-KEM to be used as a subjectPublicKey and Section 7.1.2.3 defines ML-KEM to be applicable only keyEncipherment. Naturally this only applies to end entity certificates as the CA would still require a ML-DSA subjectPublicKey to actually be able to issue certificates.

[PimvanderEijk]

There is also RFC 9935: Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). It has an example in annex C.3 of a ML-KEM-512 certificate corresponding to a public key signed with a ML-DSA private key.

[reaperhulk]

Good enough for me. If anyone wants to submit a PR adding support and a test we’d be happy to review!

[ronaldvanrij]

I’ll be happy to give it a go.

[ronaldvanrij]

I created PR #15309, which enables the use of ML-KEM public keys in X.509 certificates. It does not however implement the ability to create a CSR (PKCS#10) containing a ML-KEM public key and signed using ML-DSA according to RFC 9883, which I think is a separate issue.

@PimvanderEijk is this something you'd also be interested in?