Skip to content

Add ML-DSA-44 support alongside existing ML-DSA-65#14591

Merged
reaperhulk merged 1 commit intomainfrom
claude/extend-ml-dsa-44-CHDFB
Apr 7, 2026
Merged

Add ML-DSA-44 support alongside existing ML-DSA-65#14591
reaperhulk merged 1 commit intomainfrom
claude/extend-ml-dsa-44-CHDFB

Conversation

@alex
Copy link
Copy Markdown
Member

@alex alex commented Apr 6, 2026

Summary

  • Add ML-DSA-44 (FIPS 204 security level 2) support using the MlDsaVariant enum pattern
  • MlDsaVariant::MlDsa44 with NID, 1312-byte public key, 2420-byte signature, ml_dsa_44_sign/ml_dsa_44_verify FFI
  • X.509 OID 2.16.840.1.101.3.4.3.17, PKCS#8/SPKI parsing via MlDsaVariant::from_pkey dispatch
  • Python API: MlDsa44PrivateKey/MlDsa44PublicKey with generate_mldsa44_key, from_mldsa44_seed_bytes, from_mldsa44_public_bytes
  • ML-DSA-44 added to parameterized ML_DSA_VARIANTS test list, KAT vectors, and wycheproof tests

Test plan

  • All existing ML-DSA-65 tests continue to pass
  • ML-DSA-44 variant runs through all parameterized tests (sign/verify, serialization, context, equality, copy)
  • ML-DSA-44 KAT vectors verified
  • Wycheproof test coverage for ML-DSA-44 verify and sign-seed
  • CI passes on AWS-LC backend

https://claude.ai/code/session_01GaM5UZrNWJvnptDHvFNBWg

@alex alex force-pushed the claude/extend-ml-dsa-44-CHDFB branch 3 times, most recently from f2f495f to 8a18d58 Compare April 6, 2026 22:47
>>> from cryptography.hazmat.primitives.asymmetric.mldsa import MlDsa65PrivateKey
>>> private_key = MlDsa65PrivateKey.generate()
>>> from cryptography.hazmat.primitives.asymmetric.mldsa import MlDsa44PrivateKey
>>> private_key = MlDsa44PrivateKey.generate()
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should leave this 65 for the primary examples.

@alex alex force-pushed the claude/extend-ml-dsa-44-CHDFB branch from 8a18d58 to 9fd13af Compare April 7, 2026 02:37
from cryptography.utils import Buffer


class MlDsa44PublicKey(metaclass=abc.ABCMeta):
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know we already did this for 65, but do we want to use this casing for the Python APIs? Historically we've (at least mostly) done all caps for initialisms (e.g., SECP256R1) for the Python side.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ugh, no, we don't. Follow up PR though?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#14596 (claude will rebase this once that merges)

@reaperhulk
Copy link
Copy Markdown
Member

This needs a rebase

@alex alex force-pushed the claude/extend-ml-dsa-44-CHDFB branch from 9fd13af to 9290822 Compare April 7, 2026 12:45
@reaperhulk reaperhulk merged commit b3b3303 into main Apr 7, 2026
68 checks passed
@reaperhulk reaperhulk deleted the claude/extend-ml-dsa-44-CHDFB branch April 7, 2026 13:22
@alex alex mentioned this pull request Apr 8, 2026
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants