ssl: Make PQC signature algorithms preferred by default

Author: IngelaAndin

lib/ssl/src/ssl.erl

@@ -751,7 +751,7 @@ Common certificate related options to both client and server.
   connection will be selected.
 
   The different signature algorithms are prioritized in the following
-  order: `eddsa`, `ecdsa`, `rsa_pss_pss`, `rsa`, and `dsa`. If more
+  order: `mldsa`, `slh-dsa`, `eddsa`, `ecdsa`, `rsa_pss_pss`, `rsa`, and `dsa`. If more
   than one key is supplied for the same signature algorithm, they will
   be prioritized by strength (except for _engine keys_; see the next
   paragraph). This offers flexibility to, for instance, configure a
@@ -769,7 +769,7 @@ Common certificate related options to both client and server.
 
   > #### Note {: .info }
   >
-  > `eddsa` certificates are only supported by TLS-1.3 implementations that do not support `dsa`
+  > `mldsa`, `slhdsa`, `eddsa` certificates are only supported by TLS-1.3 implementations that do not support `dsa`
   > certificates. `rsa_pss_pss` (RSA certificates using Probabilistic Signature
   > Scheme) are supported in TLS-1.2 and TLS-1.3, but some TLS-1.2 implementations
   > do not support `rsa_pss_pss`.
@@ -3024,25 +3024,29 @@ Example:
 
 ```erlang
 1> ssl:signature_algs(default, 'tlsv1.3').
-[eddsa_ed25519,eddsa_ed448,ecdsa_secp521r1_sha512,
- ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
- ecdsa_brainpoolP512r1tls13_sha512,
- ecdsa_brainpoolP384r1tls13_sha384,
- ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,
- rsa_pss_pss_sha384,rsa_pss_pss_sha256,rsa_pss_rsae_sha512,
- rsa_pss_rsae_sha384,rsa_pss_rsae_sha256,mldsa44,mldsa65,
- mldsa87,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
+[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
+ slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
+ slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
+ slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
+ ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
+ ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
+ ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
+ rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
+ rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
  {sha512,ecdsa},
  {sha384,ecdsa},
- {sha256,ecdsa}]
+ {sha256,ecdsa}].
 
 2> ssl:signature_algs(all, 'tlsv1.3').
-[eddsa_ed25519,eddsa_ed448,ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,
- ecdsa_secp256r1_sha256,ecdsa_brainpoolP512r1tls13_sha512,
- ecdsa_brainpoolP384r1tls13_sha384,ecdsa_brainpoolP256r1tls13_sha256,
- rsa_pss_pss_sha512,rsa_pss_pss_sha384,rsa_pss_pss_sha256,rsa_pss_rsae_sha512,
- rsa_pss_rsae_sha384,rsa_pss_rsae_sha256,mldsa44,mldsa65,mldsa87,
- rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
+[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
+ slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
+ slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
+ slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
+ ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
+ ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
+ ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
+ rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
+ rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
  {sha512,ecdsa},
  {sha384,ecdsa},
  {sha256,ecdsa},
@@ -3055,15 +3059,15 @@ Example:
  {sha,dsa}]
 
 3> [ssl:signature_algs(exclusive, 'tlsv1.3').
-[eddsa_ed25519,eddsa_ed448,ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,
- ecdsa_secp256r1_sha256,ecdsa_brainpoolP512r1tls13_sha512,
- ecdsa_brainpoolP384r1tls13_sha384,ecdsa_brainpoolP256r1tls13_sha256,
- rsa_pss_pss_sha512,rsa_pss_pss_sha384,rsa_pss_pss_sha256,rsa_pss_rsae_sha512,
- rsa_pss_rsae_sha384,rsa_pss_rsae_sha256,mldsa44,mldsa65,mldsa87,
- rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,slh_dsa_shake_256f,
- slh_dsa_shake_256s,slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,
- slh_dsa_shake_192s,slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,
- slh_dsa_shake_128s,slh_dsa_sha2_128f,slh_dsa_sha2_128s]
+[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
+ slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
+ slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
+ slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
+ ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
+ ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
+ ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
+ rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
+ rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256]
 ```
 
 > #### Note {: .info }
@@ -3089,15 +3093,13 @@ signature_algs(default, 'tlsv1.2') ->
 signature_algs(all, 'tlsv1.3') ->
     tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.3'),
                                    tls_record:protocol_version_name('tlsv1.2')]) ++
-        tls_v1:slh_dsa_schemes() ++
         [ecdsa_sha1, rsa_pkcs1_sha1 | tls_v1:legacy_signature_algs_pre_13()] --
         [{sha, ecdsa}, {sha, rsa}];
 signature_algs(all, 'tlsv1.2') ->
     tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.2')]) ++
         tls_v1:legacy_signature_algs_pre_13();
 signature_algs(exclusive, 'tlsv1.3') ->
-    tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.3')]) ++
-        tls_v1:slh_dsa_schemes();
+    tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.3')]);
 signature_algs(exclusive, 'tlsv1.2') ->
     Algs = tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.2')]),
     Algs ++ tls_v1:legacy_signature_algs_pre_13();

lib/ssl/src/ssl_certificate.erl

@@ -361,7 +361,7 @@ available_cert_key_pairs(CertKeyGroups) ->
 %% Create the prioritized list of cert key pairs that
 %% are availble for use in the negotiated version
 available_cert_key_pairs(CertKeyGroups, ?TLS_1_3) ->
-    RevAlgos = [slhdsa, mldsa, rsa, rsa_pss_pss, ecdsa, eddsa],
+    RevAlgos = [rsa, rsa_pss_pss, ecdsa, eddsa, slhdsa, mldsa],
     cert_key_group_to_list(RevAlgos, CertKeyGroups, []);
 available_cert_key_pairs(CertKeyGroups, ?TLS_1_2) ->
      RevAlgos = [dsa, rsa, rsa_pss_pss, ecdsa],

lib/ssl/src/tls_v1.erl

@@ -1047,24 +1047,24 @@ signature_schemes(_, _) ->
     [].
 
 default_signature_schemes(Version) ->
-    Default = [eddsa_ed25519,
-               eddsa_ed448,
-               ecdsa_secp521r1_sha512,
-               ecdsa_secp384r1_sha384,
-               ecdsa_secp256r1_sha256,
-               ecdsa_brainpoolP512r1tls13_sha512,
-               ecdsa_brainpoolP384r1tls13_sha384,
-               ecdsa_brainpoolP256r1tls13_sha256,
-               rsa_pss_pss_sha512,
-               rsa_pss_pss_sha384,
-               rsa_pss_pss_sha256,
-               rsa_pss_rsae_sha512,
-               rsa_pss_rsae_sha384,
-               rsa_pss_rsae_sha256,
-               mldsa44,
+    Default = [mldsa87,
                mldsa65,
-               mldsa87
-              ],
+               mldsa44] ++ slh_dsa_schemes() ++
+        [eddsa_ed25519,
+         eddsa_ed448,
+         ecdsa_secp521r1_sha512,
+         ecdsa_secp384r1_sha384,
+         ecdsa_secp256r1_sha256,
+         ecdsa_brainpoolP512r1tls13_sha512,
+         ecdsa_brainpoolP384r1tls13_sha384,
+         ecdsa_brainpoolP256r1tls13_sha256,
+         rsa_pss_pss_sha512,
+         rsa_pss_pss_sha384,
+         rsa_pss_pss_sha256,
+         rsa_pss_rsae_sha512,
+         rsa_pss_rsae_sha384,
+         rsa_pss_rsae_sha256
+        ],
     signature_schemes(Version, Default).
 
 legacy_signature_schemes(Version) ->