[0.103] Support stable ML-DSA - #523
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## rel-0.103 #523 +/- ##
=============================================
- Coverage 97.42% 97.42% -0.01%
=============================================
Files 19 19
Lines 3845 3843 -2
=============================================
- Hits 3746 3744 -2
Misses 99 99 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
95de527 to
245274f
Compare
Of the form:
```
error: this `match` expression can be replaced with `?`
--> src/crl/types.rs:357:13
|
357 | / match revoked_cert_result {
358 | | Err(e) => return Err(e),
359 | | Ok(revoked_cert) => {
360 | | if revoked_cert.serial_number.eq(serial) {
... |
364 | | }
| |_____________^
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.97.0/index.html#question_mark
= note: `-D clippy::question-mark` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(clippy::question_mark)]`
```
cc5246f to
3a46dbc
Compare
|
Intended to support new signature algorithms in a stable release? |
Do you mean rustls-webpki or rustls? I definitely wanted to support them in rustls-webpki, as explained in the PR description. I was going for rustls |
ctz
left a comment
ctz
left a comment
There was a problem hiding this comment.
Sorry, I misremembered how this works and we don't rely on the ALL_VERIFICATION_ALGS collection exported here outside testing.
For rustls 0.23 let's at least wait for the RFC to be published, and maybe for someone to ask for it, and maybe a publicly trusted root or a published private example root? Like AWS Private CA or whatever.
How about rustls-aws-lc-rs 0.1 (for rustls 0.24)? Should that still get it, or should we also wait for more adoption? |
| verification_alg: &unstable::signature::ML_DSA_44, | ||
| verification_alg: &signature::ML_DSA_44, | ||
| // Not included in AWS-LC-FIPS 3.0 FIPS scope | ||
| in_fips_submission: false, |
There was a problem hiding this comment.
Is in_fips_submission: false still true? Could we see this ourselves in the NIST submission queue? I went looking earlier but forget how this works.
There was a problem hiding this comment.
I can see AWS-LC 4 in the list but not the security policy yet to see what is in scope. However I'm guessing they have not put this in aws-lc-fips-sys by mistake.
There was a problem hiding this comment.
Not a mistake. We bump to the latest FIPS branch that has completed third-party testing and has been submitted to NIST. We had a small blurb about it in our release announcement:
... The 4.x module has completed validation testing by an accredited lab and has been submitted to NIST for certification. Refer to the CMVP Modules In Progress List for its current status, and to FIPS.md for security policies and supported operating environments.
I'm not an expert on it, but my understanding is that in some restricted environments being listed by NIST as a "Module In Process" is sufficient to satisfy compliance.
4 participants
This is used in rcgen, which in turn is used in rustls-post-quantum tests.