ML-DSA Composite Signature Support

[stenslae]

Introduced support for ML-DSA composite signatures for hybrid post-quantum authentication.

• Added ML-DSA44-Ed25519 as per draft-miller-sshm-mldsa44-ed25519-composite-sigs
• Added ML-DSA44-ECDSA-P256, ML-DSA65-ECDSA-P384, ML-DSA65-ECDSA-P256, ML-DSA87-ED448, ML-DSA87-ECDSA-P384 as per draft-sun-ssh-composite-sigs-02

Added all sig types as auth options into the test echoservers, new CI tests, and interop tested mldsa44-ed25519 wtih openssh-portable.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Medium (1)

wc_MlDsaKey_ImportPubRaw result silently discarded by subsequent wc_MlDsaKey_MakeKeyFromSeed in GetOpenSshKeyMlDsaComposite

Function: GetOpenSshKeyMlDsaComposite
Category: Logic errors

The function calls wc_MlDsaKey_ImportPubRaw to import the ML-DSA public key from the OpenSSH key file, then immediately calls wc_MlDsaKey_MakeKeyFromSeed on the same key object. Per the ML-DSA specification, MakeKeyFromSeed derives a fresh key pair (both private and public halves) from the 32-byte seed, overwriting any previously imported public key material. The result of ImportPubRaw has no lasting effect on the final key state: the derived public key is used unconditionally, and the file-embedded public key is never compared against it. A key file whose stored public key does not match the seed would be silently accepted, and the mismatch would go undetected.

Recommendation: Remove the wc_MlDsaKey_ImportPubRaw call before MakeKeyFromSeed, as it has no effect. To preserve integrity validation, call wc_MlDsaKey_MakeKeyFromSeed first, then export the derived public key with wc_MlDsaKey_ExportPubRaw and compare it byte-for-byte against the pub bytes from the file. If they differ, return WS_KEY_FORMAT_E to flag a corrupted or mismatched key file.

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🔵 [Low] ECC test signature omits r/s pad bytes, diverging from production wire format · Missing edge-case coverage on a function the PR also changed

The test builds the ECC trad-signature as [rSz][rBuf][sSz][sBuf] with no leading-zero pad byte, but CompositeEccSign emits [rSz+rPad][0x00?][rBuf][sSz+sPad][0x00?][sBuf] when r[0]&0x80 or s[0]&0x80. CompositeEccVerify accepts both formats via wc_ecc_rs_raw_to_sig, so the test passes, but the padded case (the production format) is never exercised.

Fix: Mirror CompositeEccSign's padding logic: add rPad = (rBuf[0] & 0x80) ? 1 : 0 and emit [rSz+rPad][0x00?][rBuf] so the test exercises the actual production wire format.