Pq mls ciphersuites by emil-wire · Pull Request #2330 · wireapp/core-crypto

emil-wire · 2026-07-15T15:29:26Z

No description provided.

Enables the PQ provider work in the following commits.

0.14 is the first release carrying the draft-ietf-hpke-pq KEMs we need: X-Wing, ML-KEM-768 with P-256, ML-KEM-1024 with P-384, and the two standalone ML-KEM parameter sets. Its AEAD stack pulls getrandom 0.4, whose wasm backend needs the wasm_js feature.

FIPS-204 ML-DSA signatures for post-quantum support; requires 0.1.1 or later for the fix to GHSA-5x2r-hc65-25f9.

hpke 0.14 pulls x-wing with only the hazmat feature, so zeroize-on-drop for the x-wing KEM and the x25519-dalek secrets underneath it was compiled out entirely. Taking a direct dependency with both features set unifies it back on. Same reasoning for ml-dsa's signing key material. x-wing is a direct dependency for no other reason: nothing in core-crypto calls it, hpke does.

Pure FIPS-204 with an empty context, which is what MLS signs. Public keys are 1312, 1952 and 2592 bytes; signatures are 2420, 3309 and 4627 bytes. ML-DSA has no X.509 credential path, so those sites reject it.

Codepoint 0x647a from draft-ietf-hpke-pq. Hybrid uses X25519 as fallback if ML-KEM-768 fails, with SHA-3 and SHAKE internals in the hpke crate.

Codepoint 0x0050 from draft-ietf-hpke-pq, a hybrid of ML-KEM-768 and NIST P-256.

Codepoint 0x0051 from draft-ietf-hpke-pq, a hybrid of ML-KEM-1024 and NIST P-384.

Codepoints 0x0041 and 0x0042 from draft-ietf-hpke-pq, the pure ML-KEM parameter sets with no traditional hybrid.

draft-ietf-mls-pq-ciphersuites-06 suites TBD1 to TBD5, TBD7, TBD8, TBD10 and TBD11 on placeholder codepoints 0xF001 to 0xF009, since IANA has assigned nothing yet. Each uses HKDF-SHA256 or HKDF-SHA384 for the HPKE KDF and the MLS key schedule, matching the suite hash.

Pure ML-KEM-768 with Ed25519, TBD6 in draft-ietf-mls-pq-ciphersuites-06, on placeholder codepoint 0xF00A. Appending rather than renumbering keeps 0xF001 to 0xF009 meaning what they already mean. It reuses an existing HPKE config.

Needed for the ML-DSA-44 suite, the first post-quantum suite without AES-GCM. The draft chose ChaCha20Poly1305 for acceptable performance in pure software.

ML-KEM-768 + X25519 + ChaCha20Poly1305 + SHA-384 + ML-DSA-44, TBD9 in draft-ietf-mls-pq-ciphersuites-06, on placeholder codepoint 0xF00B. The only suite here pairing post-quantum signatures with the 128-bit level.

Signature and HPKE round trips through our provider dispatch across all KEM, KDF, AEAD, and ML-DSA parameter sets. Tests our wiring and algorithm mappings, not the underlying libraries.

Conversation round trips across all eleven suites, including the ML-DSA-signed ones. These are round trips rather than known-answer tests: no other implementation ships these suites yet, so they only test self-interoperability.

emil-wire added 13 commits July 10, 2026 14:22

build(deps): pin openmls to the post-quantum revision

224f1a1

Enables the PQ provider work in the following commits.

build(deps): add ml-dsa

2013d0e

FIPS-204 ML-DSA signatures for post-quantum support; requires 0.1.1 or later for the fix to GHSA-5x2r-hc65-25f9.

feat: implement ML-DSA-44, 65 and 87 signatures

90fd139

Pure FIPS-204 with an empty context, which is what MLS signs. Public keys are 1312, 1952 and 2592 bytes; signatures are 2420, 3309 and 4627 bytes. ML-DSA has no X.509 credential path, so those sites reject it.

feat: add X-Wing hybrid KEM (ML-KEM-768 + X25519)

e2548ec

Codepoint 0x647a from draft-ietf-hpke-pq. Hybrid uses X25519 as fallback if ML-KEM-768 fails, with SHA-3 and SHAKE internals in the hpke crate.

feat: add ML-KEM-768 + P-256 HPKE KEM

173e4b5

Codepoint 0x0050 from draft-ietf-hpke-pq, a hybrid of ML-KEM-768 and NIST P-256.

feat: add ML-KEM-1024 + P-384 HPKE KEM

cc795b1

Codepoint 0x0051 from draft-ietf-hpke-pq, a hybrid of ML-KEM-1024 and NIST P-384.

feat: add standalone ML-KEM-768 and ML-KEM-1024 HPKE KEMs

681f010

Codepoints 0x0041 and 0x0042 from draft-ietf-hpke-pq, the pure ML-KEM parameter sets with no traditional hybrid.

feat: add MLS-128 with ML-KEM-768 + Ed25519 cipher suite

8ed45e4

Pure ML-KEM-768 with Ed25519, TBD6 in draft-ietf-mls-pq-ciphersuites-06, on placeholder codepoint 0xF00A. Appending rather than renumbering keeps 0xF001 to 0xF009 meaning what they already mean. It reuses an existing HPKE config.

feat: add ChaCha20Poly1305 HPKE config

5808021

Needed for the ML-DSA-44 suite, the first post-quantum suite without AES-GCM. The draft chose ChaCha20Poly1305 for acceptable performance in pure software.

feat: add MLS-128 X-Wing cipher suite

0297fd7

ML-KEM-768 + X25519 + ChaCha20Poly1305 + SHA-384 + ML-DSA-44, TBD9 in draft-ietf-mls-pq-ciphersuites-06, on placeholder codepoint 0xF00B. The only suite here pairing post-quantum signatures with the 128-bit level.

emil-wire force-pushed the pq-mls-ciphersuites branch 2 times, most recently from aca29f4 to 01d9f1d Compare July 20, 2026 15:02

emil-wire added 2 commits July 20, 2026 22:47

test: cover the post-quantum provider primitives

8e87f66

Signature and HPKE round trips through our provider dispatch across all KEM, KDF, AEAD, and ML-DSA parameter sets. Tests our wiring and algorithm mappings, not the underlying libraries.

test: cover the post-quantum cipher suites end to end

c4d3d52

Conversation round trips across all eleven suites, including the ML-DSA-signed ones. These are round trips rather than known-answer tests: no other implementation ships these suites yet, so they only test self-interoperability.

emil-wire force-pushed the pq-mls-ciphersuites branch from 01d9f1d to c4d3d52 Compare July 22, 2026 10:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Pq mls ciphersuites#2330

Pq mls ciphersuites#2330
emil-wire wants to merge 15 commits into
mainfrom
pq-mls-ciphersuites

emil-wire commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant