Windows does not support new PKCS8 format for ML-DSA and ML-KEM

[PranavSenthilnathan]

Windows currently only supports an older draft of the PKCS8 format for ML-DSA and ML-KEM. We can work around this for now for the .NET implementations of ImportPkcs8PrivateKey and ExportPkcs8PrivateKey, but for PFX it requires more work that would end up being thrown away. So this scenario and associated tests have been disabled until Windows support arrives. The error for these tests, if enabled, is either of the following:

  Failed System.Security.Cryptography.X509Certificates.Tests.ExportTests.ExportPkcs12_MLDsa_Generated_Roundtrip(info: MLDsaKeyInfo { Algorithm = "ML-DSA-65" }) [5 ms]
  Error Message:
   System.Security.Cryptography.CryptographicException : Keyset does not exist
  Stack Trace:
     at System.Security.Cryptography.X509Certificates.StorePal.ExportPkcs12Core(Nullable`1 exportParameters, SafePasswordHandle password) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\StorePal.Windows.Export.cs:line 145
   at System.Security.Cryptography.X509Certificates.StorePal.ExportPkcs12(PbeParameters exportParameters, SafePasswordHandle password) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\StorePal.Windows.Export.cs:line 98
   at System.Security.Cryptography.X509Certificates.CertificatePal.ExportPkcs12(PbeParameters exportParameters, SafePasswordHandle password) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\CertificatePal.Windows.cs:line 568
   at System.Security.Cryptography.X509Certificates.X509Certificate.ExportPkcs12(PbeParameters exportParameters, String password) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509Certificate.cs:line 419
   at System.Security.Cryptography.X509Certificates.Tests.ExportTests.ExportPkcs12_MLDsa_Generated_Roundtrip(MLDsaKeyInfo info) in D:\git\runtime\src\libraries\System.Security.Cryptography\tests\X509Certificates\ExportTests.cs:line 403
   at InvokeStub_ExportTests.ExportPkcs12_MLDsa_Generated_Roundtrip(Object, Span`1)
   at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) in C:\d\git\runtime\src\libraries\System.Private.CoreLib\src\System\Reflection\MethodBaseInvoker.cs:line 95

or

Failed System.Security.Cryptography.X509Certificates.Tests.PfxTests.ReadMLDsa512PrivateKey_ExpandedKey_Pfx(keyStorageFlags: EphemeralKeySet, info: MLDsaKeyInfo { Algorithm = "ML-DSA-44" }) [< 1 ms]
  Error Message:
   System.Security.Cryptography.CryptographicException : Bad Data.
  Stack Trace:
     at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in D:\git\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in D:\git\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 86
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in D:\git\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at System.Security.Cryptography.X509Certificates.Tests.PfxTests.ReadMLDsa512PrivateKey_ExpandedKey_Pfx(X509KeyStorageFlags keyStorageFlags, MLDsaKeyInfo info) in D:\git\runtime\src\libraries\System.Security.Cryptography\tests\X509Certificates\PfxTests.cs:line 700
   at InvokeStub_PfxTests.ReadMLDsa512PrivateKey_ExpandedKey_Pfx(Object, Span`1)
   at System.Reflection.MethodBaseInvoker.InvokeWithFewArgs(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) in C:\d\git\runtime\src\libraries\System.Private.CoreLib\src\System\Reflection\MethodBaseInvoker.cs:line 136

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.