feat: update to draft-ietf-openpgp-pqc-10 (#565)

hko-s · web-flow · commit 01a96430774b · 2025-05-28T21:41:50.000+02:00
* update links to draft-ietf-openpgp-pqc

* do hash algorithm size check from draft-ietf-openpgp-pqc-10
diff --git a/Cargo.toml b/Cargo.toml
@@ -142,7 +142,7 @@ asm = ["dep:sha1-asm", "sha1/asm", "sha2/asm", "md-5/asm"]
 # Allows building for wasm
 wasm = ["chrono/wasmbind", "getrandom", "getrandom/js"]
 
-# Enables implementation of draft-ietf-openpgp-pqc-09
+# Enables implementation of draft-ietf-openpgp-pqc-10
 # This is unstable and can have breaking changes in patch releases.
 # DO NOT USE IN PRODUCTION!
 draft-pqc = ["dep:ml-kem", "dep:ml-dsa", "dep:slh-dsa"]
diff --git a/docs/IMPL_STATUS.md b/docs/IMPL_STATUS.md
@@ -94,7 +94,7 @@ see the "rpgpie" results in the [OpenPGP interoperability test suite](https://te
   - [x] Iterated and Salted
   - [x] Argon2
 
-- PQC - [Draft 09](https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html)
+- PQC - [Draft 10](https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html)
  - Encryption & Decryption
    - [x] ML-KEM-768+X25519
    - [x] ML-KEM-1024+X448
diff --git a/src/crypto/ml_kem1024_x448.rs b/src/crypto/ml_kem1024_x448.rs
@@ -161,7 +161,7 @@ impl Decryptor for SecretKey {
     }
 }
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-x448-kem>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-x448-kem>
 fn x448_kem_decaps(
     their_public: &PublicKey,
     ecdh_secret_key: &Secret,
@@ -187,7 +187,7 @@ fn ml_kem_1024_decaps(
 
 const DOM_SEP: &[u8] = b"OpenPGPCompositeKDFv1";
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-key-combiner>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-key-combiner>
 fn multi_key_combine(
     ml_kem_key_share: &[u8; 32],
     ecdh_key_share: &[u8; 56],
@@ -214,7 +214,7 @@ fn multi_key_combine(
 
 /// ML KEM 1024 - X448 Encryption
 ///
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-encryption-procedure>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-encryption-procedure>
 ///
 /// Returns
 /// - ecdh_ciphertext
@@ -255,7 +255,7 @@ pub fn encrypt<R: CryptoRng + Rng>(
     Ok((ecdh_ciphertext, ml_kem_ciphertext, c))
 }
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-x448-kem>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-x448-kem>
 fn x448_kem_encaps<R: CryptoRng + Rng>(
     mut rng: R,
     public_key: &PublicKey,
diff --git a/src/crypto/ml_kem768_x25519.rs b/src/crypto/ml_kem768_x25519.rs
@@ -164,7 +164,7 @@ impl Decryptor for SecretKey {
     }
 }
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-x25519-kem>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-x25519-kem>
 fn x25519_kem_decaps(
     ecdh_ciphertext: &[u8; 32],
     ecdh_secret_key: &x25519_dalek::StaticSecret,
@@ -191,7 +191,7 @@ fn ml_kem_768_decaps(
 
 const DOM_SEP: &[u8] = b"OpenPGPCompositeKDFv1";
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-key-combiner>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-key-combiner>
 fn multi_key_combine(
     ml_kem_key_share: &[u8; 32],
     ecdh_key_share: &[u8; 32],
@@ -218,7 +218,7 @@ fn multi_key_combine(
 
 /// ML KEM 768 - X25519 Encryption
 ///
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-encryption-procedure>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-encryption-procedure>
 ///
 /// Returns
 /// - ecdh_ciphertext
@@ -259,7 +259,7 @@ pub fn encrypt<R: CryptoRng + Rng>(
     Ok((ecdh_ciphertext, ml_kem_ciphertext, c))
 }
 
-/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-x25519-kem>
+/// <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-x25519-kem>
 fn x25519_kem_encaps<R: CryptoRng + Rng>(
     mut rng: R,
     public_key: &x25519_dalek::PublicKey,
diff --git a/src/packet/signature/config.rs b/src/packet/signature/config.rs
@@ -730,6 +730,8 @@ impl SignatureHasher {
             config.typ
         );
 
+        Signature::check_signature_hash_strength(&config)?;
+
         let len = config.hash_signature_data(&mut hasher)?;
         let trailer = config.trailer(len)?;
         hasher.update(&trailer);
diff --git a/src/packet/signature/types.rs b/src/packet/signature/types.rs
@@ -318,6 +318,30 @@ impl Signature {
         Ok(())
     }
 
+    /// Check if the hash algorithm is acceptable for the signature configuration
+    /// (in particular, if it's allowed in combination with the public key algorithm).
+    pub(crate) fn check_signature_hash_strength(config: &SignatureConfig) -> Result<()> {
+        if config.pub_alg.is_pqc() {
+            // For all signature algorithms in draft-ietf-openpgp-pqc-10,
+            // hash digest sizes of at least 256 bits are required:
+            //
+            // https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-signature-packet-tag-2
+            // https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-signature-packet-tag-2-2
+
+            let Some(digest_size) = config.hash_alg.digest_size() else {
+                bail!("Illegal hash_alg setting {}", config.hash_alg);
+            };
+
+            ensure!(
+                digest_size * 8 >= 256,
+                "PQC signatures must use hash algorithms with digest size >= 256 bits, {} is insufficient",
+                config.hash_alg
+            );
+        }
+
+        Ok(())
+    }
+
     /// Verify this signature.
     pub fn verify<R>(&self, key: &impl PublicKeyTrait, data: R) -> Result<()>
     where
@@ -333,6 +357,7 @@ impl Signature {
         };
 
         Self::check_signature_key_version_alignment(&key, config)?;
+        Self::check_signature_hash_strength(config)?;
 
         ensure!(
             Self::match_identity(self, key),
@@ -420,6 +445,7 @@ impl Signature {
         debug!("verifying certification {:?} {:#?}", key_id, self);
 
         Self::check_signature_key_version_alignment(&signer, config)?;
+        Self::check_signature_hash_strength(config)?;
 
         ensure!(
             Self::match_identity(self, signer),
@@ -509,6 +535,7 @@ impl Signature {
         };
 
         Self::check_signature_key_version_alignment(&signer, config)?;
+        Self::check_signature_hash_strength(config)?;
 
         let mut hasher = config.hash_alg.new_hasher()?;
 
@@ -557,6 +584,7 @@ impl Signature {
         };
 
         Self::check_signature_key_version_alignment(&signer, config)?;
+        Self::check_signature_hash_strength(config)?;
 
         let mut hasher = config.hash_alg.new_hasher()?;
 
@@ -596,6 +624,7 @@ impl Signature {
             unsupported_err!("signature version {:?}", self.version());
         };
         Self::check_signature_key_version_alignment(&key, config)?;
+        Self::check_signature_hash_strength(config)?;
 
         ensure!(
             Self::match_identity(self, key),
diff --git a/src/types/pkesk.rs b/src/types/pkesk.rs
@@ -166,7 +166,7 @@ impl PkeskBytes {
             PublicKeyAlgorithm::Unknown(_) => Ok(PkeskBytes::Other), // we don't know the format of this data
             #[cfg(feature = "draft-pqc")]
             PublicKeyAlgorithm::MlKem768X25519 => {
-                // <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-public-key-encrypted-sessio>
+                // <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-public-key-encrypted-sessio>
 
                 // A fixed-length octet string representing an ECDH ephemeral public key in the format associated with
                 // the curve as specified in Section 4.1.1.
@@ -203,7 +203,7 @@ impl PkeskBytes {
             }
             #[cfg(feature = "draft-pqc")]
             PublicKeyAlgorithm::MlKem1024X448 => {
-                // <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-09.html#name-public-key-encrypted-sessio>
+                // <https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-10.html#name-public-key-encrypted-sessio>
 
                 // A fixed-length octet string representing an ECDH ephemeral public key in the format associated with
                 // the curve as specified in Section 4.1.1.
