Skip to content

Commit ef4e830

Browse files
vdukhovnihs-viktor
vdukhovni
and
hs-viktor
authored
Updated compat matrices (#193)
Co-authored-by: Viktor Dukhovni <ietf-dane@dukhovni.org>
1 parent 4689dbf commit ef4e830

9 files changed

+288
-5
lines changed

‎docs/compat_matrix_instructions.md

+58
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,64 @@ The `rebuild_results.sh` script will compile the interop test results from all p
77
If you have updated your test results, then please re-run `rebuild_reselts.sh` before committing.
88
https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results.html displays the /docs folder of the `master` branch.
99

10+
## The interoperability results format R5
11+
12+
Results for the R5 *certs* tests should be placed in
13+
`providers/<provider_name>/compatMatrices/artifacts_certs_r5/<producer>_<consumer>.csv`.
14+
Because there in this format there can be multiple files for each OID (up to
15+
three private key formats, a certificate, and for ML-KEM possible ciphertext
16+
and shared secret), there are now three columns in the CSV file. For example,
17+
the results for ML-DSA-44 and SLH-DSA-SHA2-128s might be:
18+
19+
```
20+
key_algorithm_oid,type,test_result
21+
2.16.840.1.101.3.4.3.17,cert,Y
22+
2.16.840.1.101.3.4.3.17,seed,Y
23+
2.16.840.1.101.3.4.3.17,expandedkey,Y
24+
2.16.840.1.101.3.4.3.17,both,Y
25+
2.16.840.1.101.3.4.3.17,consistent,Y
26+
2.16.840.1.101.3.4.3.20,priv,Y
27+
2.16.840.1.101.3.4.3.20,cert,Y
28+
```
29+
30+
The `type` column takes the following values:
31+
32+
- cert
33+
- The TA certificate (ML-DSA or SLH-DSA) had a valid self-signature, or
34+
- The ML-KEM EE certificate had a valid signature, by the associated ML-DSA TA.
35+
- priv
36+
- The single SLH-DSA private key form was well formed.
37+
- A signature made with the private key can be verified with the
38+
corresponding public key.
39+
- seed
40+
- The seed form of an ML-DSA or ML-KEM private key form was well formed.
41+
- A signature made with that ML-DSA private key can be verified with the
42+
corresponding public key.
43+
- The encapsulation ciphertext provided for that ML-KEM OID decapsulates
44+
via the seed-only key to a shared secret identical with the provided
45+
shared secret.
46+
- expandedkey
47+
- The expanded key form of an ML-DSA or ML-KEM private key form was well
48+
formed.
49+
- A signature made with that ML-DSA private key can be verified with the
50+
corresponding public key.
51+
- The encapsulation ciphertext provided for that ML-KEM OID decapsulates
52+
via the expanded key to a shared secret identical with the provided
53+
shared secret.
54+
- both
55+
- The seed plus expanded key (both) form of an ML-DSA or ML-KEM private key
56+
form was well formed.
57+
- A signature made with that ML-DSA private key can be verified with the
58+
corresponding public key.
59+
- The encapsulation ciphertext provided for that ML-KEM OID decapsulates
60+
via the seed plus expanded key form to a shared secret identical with the
61+
provided shared secret.
62+
- consistent
63+
- All the private key forms yield the same public key form, that is also
64+
the public key in the certificate.
65+
- This test is not applicable if only a certificate and no keys, or only
66+
one key and no certificate is provided.
67+
1068
## The interoperability results format R3
1169

1270
This is simplified relative to the R2 format.

‎providers/ossl35/check_certs.sh

+5-5
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ if [[ $# != 1 ]]; then die 'Usage: %s <zipfile>\n' "$0"; fi
66
xxd -p </dev/null || die 'Missing xxd command\n'
77

88
case $(openssl version -v) in
9-
"OpenSSL 3.5".*) : ;;
9+
"OpenSSL 3".[56].*) : ;;
1010
*) die 'Unsupported OpenSSL version\n';;
1111
esac
1212

@@ -55,7 +55,7 @@ check_keys() {
5555
fi;;
5656
ta) openssl x509 -in "$obj" -pubkey -noout |
5757
openssl pkey -pubin -pubout -outform DER -out "$pubout" &&
58-
openssl verify -verify_depth 0 -trusted "$obj" "$obj" >/dev/null &&
58+
openssl verify -verify_depth 0 -check_ss_sig -trusted "$obj" "$obj" >/dev/null &&
5959
ta_file="$obj" &&
6060
dgst=$(openssl dgst -sha256 -binary < "$pubout" | xxd -p -c32) &&
6161
pubs=("${pubs[@]}" "$dgst") &&
@@ -68,10 +68,10 @@ check_keys() {
6868
pubs=("${pubs[@]}" "$dgst") &&
6969
printf "%s,%s,%s\n" "${oid}" "cert" "Y" ||
7070
printf "%s,%s,%s\n" "${oid}" "cert" "N";;
71-
*) openssl pkey -in "$obj" -pubout -outform DER -out "$pubout" &&
71+
*) openssl pkey -inform DER -in "$obj" -pubout -outform DER -out "$pubout" &&
7272
if [[ -n "$sigfile" ]]; then
73-
openssl pkeyutl -sign -rawin -inkey "$obj" -in "$ptext" -out "$sigfile" &&
74-
openssl pkeyutl -verify -rawin -in "$ptext" -pubin -inkey "$pubout" \
73+
openssl pkeyutl -sign -rawin -keyform DER -inkey "$obj" -in "$ptext" -out "$sigfile" &&
74+
openssl pkeyutl -verify -rawin -in "$ptext" -keyform DER -pubin -inkey "$pubout" \
7575
-sigfile "$sigfile" >/dev/null
7676
elif [[ -n "$ct_file" && -n "$ss_file" ]]; then
7777
cmp -s "$ss_file" <(

‎providers/ossl35/compatMatrices/artifacts_certs_r5/bc_ossl35.csv

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
key_algorithm_oid,type,test_result
2+
2.16.840.1.101.3.4.3.21,priv,Y
3+
2.16.840.1.101.3.4.3.21,cert,Y
4+
2.16.840.1.101.3.4.3.21,consistent,Y
5+
2.16.840.1.101.3.4.3.20,priv,Y
6+
2.16.840.1.101.3.4.3.20,cert,Y
7+
2.16.840.1.101.3.4.3.20,consistent,Y
8+
2.16.840.1.101.3.4.3.27,priv,Y
9+
2.16.840.1.101.3.4.3.27,cert,Y
10+
2.16.840.1.101.3.4.3.27,consistent,Y
11+
2.16.840.1.101.3.4.3.26,priv,Y
12+
2.16.840.1.101.3.4.3.26,cert,Y
13+
2.16.840.1.101.3.4.3.26,consistent,Y
14+
2.16.840.1.101.3.4.3.17,seed,Y
15+
2.16.840.1.101.3.4.3.17,expandedkey,Y
16+
2.16.840.1.101.3.4.3.17,cert,Y
17+
2.16.840.1.101.3.4.3.17,consistent,Y
18+
2.16.840.1.101.3.4.4.1,seed,Y
19+
2.16.840.1.101.3.4.4.1,expandedkey,Y
20+
2.16.840.1.101.3.4.4.1,cert,Y
21+
2.16.840.1.101.3.4.4.1,consistent,Y
22+
2.16.840.1.101.3.4.3.23,priv,Y
23+
2.16.840.1.101.3.4.3.23,cert,Y
24+
2.16.840.1.101.3.4.3.23,consistent,Y
25+
2.16.840.1.101.3.4.3.22,priv,Y
26+
2.16.840.1.101.3.4.3.22,cert,Y
27+
2.16.840.1.101.3.4.3.22,consistent,Y
28+
2.16.840.1.101.3.4.3.29,priv,Y
29+
2.16.840.1.101.3.4.3.29,cert,Y
30+
2.16.840.1.101.3.4.3.29,consistent,Y
31+
2.16.840.1.101.3.4.3.28,priv,Y
32+
2.16.840.1.101.3.4.3.28,cert,Y
33+
2.16.840.1.101.3.4.3.28,consistent,Y
34+
2.16.840.1.101.3.4.3.18,seed,Y
35+
2.16.840.1.101.3.4.3.18,expandedkey,Y
36+
2.16.840.1.101.3.4.3.18,cert,Y
37+
2.16.840.1.101.3.4.3.18,consistent,Y
38+
2.16.840.1.101.3.4.4.2,seed,Y
39+
2.16.840.1.101.3.4.4.2,expandedkey,Y
40+
2.16.840.1.101.3.4.4.2,cert,Y
41+
2.16.840.1.101.3.4.4.2,consistent,Y
42+
2.16.840.1.101.3.4.3.25,priv,Y
43+
2.16.840.1.101.3.4.3.25,cert,Y
44+
2.16.840.1.101.3.4.3.25,consistent,Y
45+
2.16.840.1.101.3.4.3.24,priv,Y
46+
2.16.840.1.101.3.4.3.24,cert,Y
47+
2.16.840.1.101.3.4.3.24,consistent,Y
48+
2.16.840.1.101.3.4.3.31,priv,Y
49+
2.16.840.1.101.3.4.3.31,cert,Y
50+
2.16.840.1.101.3.4.3.31,consistent,Y
51+
2.16.840.1.101.3.4.3.30,priv,Y
52+
2.16.840.1.101.3.4.3.30,cert,Y
53+
2.16.840.1.101.3.4.3.30,consistent,Y
54+
2.16.840.1.101.3.4.3.19,seed,Y
55+
2.16.840.1.101.3.4.3.19,expandedkey,Y
56+
2.16.840.1.101.3.4.3.19,cert,Y
57+
2.16.840.1.101.3.4.3.19,consistent,Y
58+
2.16.840.1.101.3.4.4.3,seed,Y
59+
2.16.840.1.101.3.4.4.3,expandedkey,Y
60+
2.16.840.1.101.3.4.4.3,cert,Y
61+
2.16.840.1.101.3.4.4.3,consistent,Y

‎providers/ossl35/compatMatrices/artifacts_certs_r5/carl-redhound_ossl35.csv

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
key_algorithm_oid,type,test_result
2+
2.16.840.1.101.3.4.3.21,priv,Y
3+
2.16.840.1.101.3.4.3.21,cert,Y
4+
2.16.840.1.101.3.4.3.21,consistent,Y
5+
2.16.840.1.101.3.4.3.20,priv,Y
6+
2.16.840.1.101.3.4.3.20,cert,Y
7+
2.16.840.1.101.3.4.3.20,consistent,Y
8+
2.16.840.1.101.3.4.3.27,priv,Y
9+
2.16.840.1.101.3.4.3.27,cert,Y
10+
2.16.840.1.101.3.4.3.27,consistent,Y
11+
2.16.840.1.101.3.4.3.26,priv,Y
12+
2.16.840.1.101.3.4.3.26,cert,Y
13+
2.16.840.1.101.3.4.3.26,consistent,Y
14+
2.16.840.1.101.3.4.3.17,seed,Y
15+
2.16.840.1.101.3.4.3.17,expandedkey,Y
16+
2.16.840.1.101.3.4.3.17,both,Y
17+
2.16.840.1.101.3.4.3.17,cert,Y
18+
2.16.840.1.101.3.4.3.17,consistent,Y
19+
2.16.840.1.101.3.4.3.23,priv,Y
20+
2.16.840.1.101.3.4.3.23,cert,Y
21+
2.16.840.1.101.3.4.3.23,consistent,Y
22+
2.16.840.1.101.3.4.3.22,priv,Y
23+
2.16.840.1.101.3.4.3.22,cert,Y
24+
2.16.840.1.101.3.4.3.22,consistent,Y
25+
2.16.840.1.101.3.4.3.29,priv,Y
26+
2.16.840.1.101.3.4.3.29,cert,Y
27+
2.16.840.1.101.3.4.3.29,consistent,Y
28+
2.16.840.1.101.3.4.3.28,priv,Y
29+
2.16.840.1.101.3.4.3.28,cert,Y
30+
2.16.840.1.101.3.4.3.28,consistent,Y
31+
2.16.840.1.101.3.4.3.18,seed,Y
32+
2.16.840.1.101.3.4.3.18,expandedkey,Y
33+
2.16.840.1.101.3.4.3.18,both,Y
34+
2.16.840.1.101.3.4.3.18,cert,Y
35+
2.16.840.1.101.3.4.3.18,consistent,Y
36+
2.16.840.1.101.3.4.3.25,priv,Y
37+
2.16.840.1.101.3.4.3.25,cert,Y
38+
2.16.840.1.101.3.4.3.25,consistent,Y
39+
2.16.840.1.101.3.4.3.24,priv,Y
40+
2.16.840.1.101.3.4.3.24,cert,Y
41+
2.16.840.1.101.3.4.3.24,consistent,Y
42+
2.16.840.1.101.3.4.3.31,priv,Y
43+
2.16.840.1.101.3.4.3.31,cert,Y
44+
2.16.840.1.101.3.4.3.31,consistent,Y
45+
2.16.840.1.101.3.4.3.30,priv,Y
46+
2.16.840.1.101.3.4.3.30,cert,Y
47+
2.16.840.1.101.3.4.3.30,consistent,Y
48+
2.16.840.1.101.3.4.3.19,seed,Y
49+
2.16.840.1.101.3.4.3.19,expandedkey,Y
50+
2.16.840.1.101.3.4.3.19,both,Y
51+
2.16.840.1.101.3.4.3.19,cert,Y
52+
2.16.840.1.101.3.4.3.19,consistent,Y

‎providers/ossl35/compatMatrices/artifacts_certs_r5/corey-digicert_ossl35.csv

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
2.16.840.1.101.3.4.3.17,seed,Y
2+
2.16.840.1.101.3.4.3.17,expandedkey,Y
3+
2.16.840.1.101.3.4.3.17,both,Y
4+
2.16.840.1.101.3.4.3.17,cert,Y
5+
2.16.840.1.101.3.4.3.17,consistent,Y
6+
2.16.840.1.101.3.4.3.18,seed,Y
7+
2.16.840.1.101.3.4.3.18,expandedkey,Y
8+
2.16.840.1.101.3.4.3.18,both,Y
9+
2.16.840.1.101.3.4.3.18,cert,Y
10+
2.16.840.1.101.3.4.3.18,consistent,Y
11+
2.16.840.1.101.3.4.3.19,seed,Y
12+
2.16.840.1.101.3.4.3.19,expandedkey,Y
13+
2.16.840.1.101.3.4.3.19,both,Y
14+
2.16.840.1.101.3.4.3.19,cert,Y
15+
2.16.840.1.101.3.4.3.19,consistent,Y

‎providers/ossl35/compatMatrices/artifacts_certs_r5/crypto4a_ossl35.csv

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2.16.840.1.101.3.4.3.17,both,Y
2+
2.16.840.1.101.3.4.3.17,cert,Y
3+
2.16.840.1.101.3.4.3.17,consistent,Y
4+
2.16.840.1.101.3.4.3.18,both,Y
5+
2.16.840.1.101.3.4.3.18,cert,Y
6+
2.16.840.1.101.3.4.3.18,consistent,Y
7+
2.16.840.1.101.3.4.3.19,both,Y
8+
2.16.840.1.101.3.4.3.19,cert,Y
9+
2.16.840.1.101.3.4.3.19,consistent,Y

‎providers/ossl35/compatMatrices/artifacts_certs_r5/cryptonext_ossl35.csv

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
key_algorithm_oid,type,test_result
2+
2.16.840.1.101.3.4.3.21,priv,Y
3+
2.16.840.1.101.3.4.3.21,cert,Y
4+
2.16.840.1.101.3.4.3.21,consistent,Y
5+
2.16.840.1.101.3.4.3.20,priv,Y
6+
2.16.840.1.101.3.4.3.20,cert,Y
7+
2.16.840.1.101.3.4.3.20,consistent,Y
8+
2.16.840.1.101.3.4.3.27,priv,Y
9+
2.16.840.1.101.3.4.3.27,cert,Y
10+
2.16.840.1.101.3.4.3.27,consistent,Y
11+
2.16.840.1.101.3.4.3.26,priv,Y
12+
2.16.840.1.101.3.4.3.26,cert,Y
13+
2.16.840.1.101.3.4.3.26,consistent,Y
14+
2.16.840.1.101.3.4.3.17,seed,Y
15+
2.16.840.1.101.3.4.3.17,expandedkey,Y
16+
2.16.840.1.101.3.4.3.17,both,Y
17+
2.16.840.1.101.3.4.3.17,cert,Y
18+
2.16.840.1.101.3.4.3.17,consistent,Y
19+
2.16.840.1.101.3.4.4.1,seed,Y
20+
2.16.840.1.101.3.4.4.1,expandedkey,Y
21+
2.16.840.1.101.3.4.4.1,both,Y
22+
2.16.840.1.101.3.4.4.1,cert,Y
23+
2.16.840.1.101.3.4.4.1,consistent,Y
24+
2.16.840.1.101.3.4.3.23,priv,Y
25+
2.16.840.1.101.3.4.3.23,cert,Y
26+
2.16.840.1.101.3.4.3.23,consistent,Y
27+
2.16.840.1.101.3.4.3.22,priv,Y
28+
2.16.840.1.101.3.4.3.22,cert,Y
29+
2.16.840.1.101.3.4.3.22,consistent,Y
30+
2.16.840.1.101.3.4.3.29,priv,Y
31+
2.16.840.1.101.3.4.3.29,cert,Y
32+
2.16.840.1.101.3.4.3.29,consistent,Y
33+
2.16.840.1.101.3.4.3.28,priv,Y
34+
2.16.840.1.101.3.4.3.28,cert,Y
35+
2.16.840.1.101.3.4.3.28,consistent,Y
36+
2.16.840.1.101.3.4.3.18,seed,Y
37+
2.16.840.1.101.3.4.3.18,expandedkey,Y
38+
2.16.840.1.101.3.4.3.18,both,Y
39+
2.16.840.1.101.3.4.3.18,cert,Y
40+
2.16.840.1.101.3.4.3.18,consistent,Y
41+
2.16.840.1.101.3.4.4.2,seed,Y
42+
2.16.840.1.101.3.4.4.2,expandedkey,Y
43+
2.16.840.1.101.3.4.4.2,both,Y
44+
2.16.840.1.101.3.4.4.2,cert,Y
45+
2.16.840.1.101.3.4.4.2,consistent,Y
46+
2.16.840.1.101.3.4.3.25,priv,Y
47+
2.16.840.1.101.3.4.3.25,cert,Y
48+
2.16.840.1.101.3.4.3.25,consistent,Y
49+
2.16.840.1.101.3.4.3.24,priv,Y
50+
2.16.840.1.101.3.4.3.24,cert,Y
51+
2.16.840.1.101.3.4.3.24,consistent,Y
52+
2.16.840.1.101.3.4.3.31,priv,Y
53+
2.16.840.1.101.3.4.3.31,cert,Y
54+
2.16.840.1.101.3.4.3.31,consistent,Y
55+
2.16.840.1.101.3.4.3.30,priv,Y
56+
2.16.840.1.101.3.4.3.30,cert,Y
57+
2.16.840.1.101.3.4.3.30,consistent,Y
58+
2.16.840.1.101.3.4.3.19,seed,Y
59+
2.16.840.1.101.3.4.3.19,expandedkey,Y
60+
2.16.840.1.101.3.4.3.19,both,Y
61+
2.16.840.1.101.3.4.3.19,cert,Y
62+
2.16.840.1.101.3.4.3.19,consistent,Y
63+
2.16.840.1.101.3.4.4.3,seed,Y
64+
2.16.840.1.101.3.4.4.3,expandedkey,Y
65+
2.16.840.1.101.3.4.4.3,both,Y
66+
2.16.840.1.101.3.4.4.3,cert,Y
67+
2.16.840.1.101.3.4.4.3,consistent,Y

‎providers/ossl35/compatMatrices/artifacts_certs_r5/entrust_ossl35.csv

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
2.16.840.1.101.3.4.3.17,expandedkey,N
2+
2.16.840.1.101.3.4.3.17,cert,Y
3+
2.16.840.1.101.3.4.3.18,expandedkey,N
4+
2.16.840.1.101.3.4.3.18,cert,Y
5+
2.16.840.1.101.3.4.3.19,cert,Y

‎providers/ossl35/compatMatrices/artifacts_cms_v3/cryptonext_ossl35.csv

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
key_algorithm_oid,test_result
2+
2.16.840.1.101.3.4.3.17,Y
3+
2.16.840.1.101.3.4.3.21,Y
4+
2.16.840.1.101.3.4.3.20,Y
5+
2.16.840.1.101.3.4.3.27,N
6+
2.16.840.1.101.3.4.3.26,N
7+
2.16.840.1.101.3.4.3.18,Y
8+
2.16.840.1.101.3.4.3.23,Y
9+
2.16.840.1.101.3.4.3.22,Y
10+
2.16.840.1.101.3.4.3.29,Y
11+
2.16.840.1.101.3.4.3.28,Y
12+
2.16.840.1.101.3.4.3.19,Y
13+
2.16.840.1.101.3.4.3.25,Y
14+
2.16.840.1.101.3.4.3.24,Y
15+
2.16.840.1.101.3.4.3.31,N
16+
2.16.840.1.101.3.4.3.30,N

0 commit comments

Comments
 (0)