Ingela/ssl/public key/pqa slh dsa/otp 19867 #10398
Open
+1,925
−575
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
IngelaAndin
requested review from
bjorng,
Copilot and
dgud
and removed request for
bjorng
Contributor
CT Test Results 4 files 75 suites 26m 7s ⏱️ For more details on these failures, see this check. Results for commit 3c26cd2. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts
// Erlang/OTP Github Action Bot |
There was a problem hiding this comment.
Pull request overview
This pull request adds comprehensive support for SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), a post-quantum cryptographic signature scheme, to both the public_key and ssl libraries in Erlang/OTP. The implementation follows patterns established by the existing ML-DSA support.
Key Changes
- Added 12 SLH-DSA algorithm variants (SHA2 and SHAKE variants with 128s/f, 192s/f, and 256s/f parameter sets)
- Implemented SLH-DSA key generation, signing, and verification in public_key module
- Extended SSL/TLS 1.3 handshake support for SLH-DSA signature schemes
- Added comprehensive test coverage including key encoding/decoding, signing/verification, and certificate tests
Reviewed changes
Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| lib/ssl/test/ssl_test_lib.erl | Added test helper functions for SLH-DSA signature algorithms and key specifications |
| lib/ssl/test/ssl_cert_tests.erl | Added SLH-DSA SHA2 and SHAKE configuration functions and key generation utilities |
| lib/ssl/test/ssl_cert_SUITE.erl | Added SLH-DSA test groups to the test suite |
| lib/ssl/src/tls_v1.erl | Added slh_dsa_schemes/0 function and signature scheme handling for all 12 SLH-DSA variants |
| lib/ssl/src/tls_handshake_1_3.hrl | Defined signature scheme constants for all SLH-DSA variants |
| lib/ssl/src/tls_handshake_1_3.erl | Updated signature algorithm selection and verification logic for SLH-DSA |
| lib/ssl/src/ssl_handshake.erl | Added SLH-DSA signature verification and signing support |
| lib/ssl/src/ssl_config.erl | Added SLH-DSA private key handling and prioritization logic (with bug) |
| lib/ssl/src/ssl_cipher.erl | Added signature scheme encoding/decoding for all SLH-DSA variants |
| lib/ssl/src/ssl_certificate.erl | Added SLH-DSA to available certificate key pairs for TLS 1.3 |
| lib/ssl/src/ssl.erl | Added post_quantum_schemes type and signature algorithm handling (with bug) |
| lib/public_key/test/public_key_SUITE_data/*.pem | Added test PEM files for SLH-DSA keys and certificates |
| lib/public_key/test/public_key_SUITE.erl | Added SLH-DSA key encoding/decoding and signing/verification tests |
| lib/public_key/src/public_key_internal.hrl | Defined SLH-DSAPrivateKey and SLH-DSAPublicKey records |
| lib/public_key/src/public_key.erl | Implemented key generation, encoding/decoding, signing, and verification for SLH-DSA |
| lib/public_key/src/pubkey_cert_records.erl | Added OID to algorithm mapping functions for SLH-DSA |
| lib/public_key/src/pubkey_cert.erl | Added SLH-DSA signature verification and encoding support |
| lib/public_key/include/public_key.hrl | Defined public SLH-DSA record types and OID macros |
| lib/public_key/asn1/SLH-DSA-Module-2024.asn1 | Added complete ASN.1 module defining SLH-DSA structures per RFC specification |
| lib/public_key/asn1/Makefile | Added SLH-DSA-Module-2024 to ASN.1 compilation list |
| lib/crypto/src/crypto.erl | Exported slh_dsa/0 type |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
from
1952be6 to
766d83c
Compare
Copilot finished reviewing on behalf of
IngelaAndin
November 21, 2025 16:23
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
6 times, most recently
from
ecc5284 to
f787a1e
Compare
IngelaAndin
added
the
testing
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
from
f373ceb to
d9c0ac2
Compare
u3s
reviewed
Nov 24, 2025
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
2 times, most recently
from
1abc9d2 to
f3b2771
Compare
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
from
f3b2771 to
7397ffc
Compare
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
4 times, most recently
from
71083cf to
7eee90e
Compare
IngelaAndin
added
testing
dgud
reviewed
Nov 25, 2025
dgud
previously approved these changes
Nov 25, 2025
u3s
previously approved these changes
Nov 25, 2025
Also remove white space errors in test suite
Also remove white space errors and too long lines and no longer needed deprecation supressions.
Correct doc and fix whitespace errors and long lines
IngelaAndin
force-pushed
the
ingela/ssl/public_key/pqa-SLH-DSA/OTP-19867
branch
from
7eee90e to
3c26cd2
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support in public_key and ssl for SLH-DSA