-
Notifications
You must be signed in to change notification settings - Fork 32
Add generating Chimera certs #182
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add generating Chimera certs #182
Conversation
|
Can one of the admins verify this patch? |
|
Ok to test Jenkins |
|
The FIPS CI failure is due to more restrictive algorithms now. Removing the use of DES and causing decryption of DES encrypted keys to fail. This PR (#183) adjusts the test cases to account for that. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds support for generating Chimera certificates, which implement dual-algorithm cryptography combining traditional ECC with post-quantum ML-DSA signatures. The implementation includes new command-line options, key generation functionality for ML-DSA, and a comprehensive certificate generation function that creates certificates with dual cryptographic signatures.
- Adds ML-DSA key generation capabilities alongside existing Dilithium support
- Implements Chimera certificate generation with dual ECC/ML-DSA signatures
- Extends CA setup with new command-line options for alternate keys and extended signing modes
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfclu/x509/clu_x509_sign.h | Adds function declaration for Chimera certificate generation |
| wolfclu/genkey/clu_genkey.h | Adds ML-DSA key generation function declaration with documentation |
| wolfclu/clu_optargs.h | Defines new command-line option constants for alternate keys and extended signing |
| tests/x509/expect-purpose.txt | Updates test expectation for TLS Web Client Authentication |
| src/x509/clu_x509_sign.c | Implements comprehensive Chimera certificate generation function |
| src/x509/clu_ca_setup.c | Extends CA setup with new options and alternate signing workflow |
| src/tools/clu_funcs.c | Adds ML-DSA to help documentation |
| src/genkey/clu_genkey_setup.c | Adds ML-DSA key generation setup and argument parsing |
| src/genkey/clu_genkey.c | Implements ML-DSA key generation functionality |
| README.md | Documents Chimera certificate creation workflow with examples |
|
@Yu-Ma28051503 please assign to wolfSSL-bot or ping me on slack when ready for a re-review. |
JacobBarthelmeh
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for adding the test cases! Please resolve the CI reports.
The following items have not yet been implemented,