groups: register SecP256r1MLKEM768 and X25519MLKEM768

This adds entries for SecP256r1MLKEM768 and X25519MLKEM768
post-quantum hybrid key agreement schemes as defined in
draft-kwiatkowski-tls-ecdhe-mlkem.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/lib/algorithms/groups.c b/lib/algorithms/groups.c
index 7b52f931488228c51b396171c5cee810219d7790..88d0cf630ac0e496ce3302fae6b2a19c0398b156 100644 (file)
--- a/lib/algorithms/groups.c
+++ b/lib/algorithms/groups.c
@@ -30,12 +30,29 @@
 /* Supported ECC curves
  */
 
+#ifdef HAVE_LIBOQS
+static const gnutls_group_entry_st group_mlkem768 = {
+       .name = "MLKEM768",
+       .id = GNUTLS_GROUP_INVALID,
+       .curve = GNUTLS_ECC_CURVE_INVALID,
+       .pk = GNUTLS_PK_MLKEM768,
+};
+
 static const gnutls_group_entry_st group_kyber768 = {
        .name = "KYBER768",
        .id = GNUTLS_GROUP_INVALID,
        .curve = GNUTLS_ECC_CURVE_INVALID,
        .pk = GNUTLS_PK_EXP_KYBER768,
 };
+#endif
+
+static const gnutls_group_entry_st group_x25519 = {
+       .name = "X25519",
+       .id = GNUTLS_GROUP_X25519,
+       .curve = GNUTLS_ECC_CURVE_X25519,
+       .tls_id = 29,
+       .pk = GNUTLS_PK_ECDH_X25519,
+};
 
 static const gnutls_group_entry_st supported_groups[] = {
        {
@@ -73,11 +90,7 @@ static const gnutls_group_entry_st supported_groups[] = {
                .tls_id = 25,
                .pk = GNUTLS_PK_ECDSA,
        },
-       { .name = "X25519",
-         .id = GNUTLS_GROUP_X25519,
-         .curve = GNUTLS_ECC_CURVE_X25519,
-         .tls_id = 29,
-         .pk = GNUTLS_PK_ECDH_X25519 },
+       group_x25519,
 #ifdef ENABLE_GOST
        /* draft-smyshlyaev-tls12-gost-suites-06, Section 6 */
        {
@@ -178,6 +191,18 @@ static const gnutls_group_entry_st supported_groups[] = {
          .tls_id = 0x104 },
 #endif
 #ifdef HAVE_LIBOQS
+       { .name = "SECP256R1-MLKEM768",
+         .id = GNUTLS_GROUP_EXP_SECP256R1_MLKEM768,
+         .curve = GNUTLS_ECC_CURVE_SECP256R1,
+         .pk = GNUTLS_PK_ECDSA,
+         .tls_id = 0x11EB,
+         .next = &group_mlkem768 },
+       { .name = "X25519-MLKEM768",
+         .id = GNUTLS_GROUP_EXP_X25519_MLKEM768,
+         .curve = GNUTLS_ECC_CURVE_INVALID,
+         .pk = GNUTLS_PK_MLKEM768,
+         .tls_id = 0x11EC,
+         .next = &group_x25519 },
        { .name = "X25519-KYBER768",
          .id = GNUTLS_GROUP_EXP_X25519_KYBER768,
          .curve = GNUTLS_ECC_CURVE_X25519,

diff --git a/lib/ext/key_share.c b/lib/ext/key_share.c
index a0596d0b3533dfd11cb4d18ea143f5af94265a1f..70495eac99106f147018e55d9cdb91e7774275f2 100644 (file)
--- a/lib/ext/key_share.c
+++ b/lib/ext/key_share.c
@@ -183,6 +183,7 @@ static int client_gen_key_share_single(gnutls_session_t session,
                ret = 0;
                break;
 
+       case GNUTLS_PK_MLKEM768:
        case GNUTLS_PK_EXP_KYBER768:
                gnutls_pk_params_release(&session->key.kshare.kem_params);
                gnutls_pk_params_init(&session->key.kshare.kem_params);
@@ -311,6 +312,7 @@ static int server_gen_key_share_single(gnutls_session_t session,
                ret = 0;
                break;
 
+       case GNUTLS_PK_MLKEM768:
        case GNUTLS_PK_EXP_KYBER768:
                ret = gnutls_buffer_append_data(
                        extdata, session->key.kshare.kem_params.raw_pub.data,
@@ -546,6 +548,7 @@ static int server_use_key_share_single(gnutls_session_t session,
 
                return 0;
 
+       case GNUTLS_PK_MLKEM768:
        case GNUTLS_PK_EXP_KYBER768: {
                gnutls_pk_params_release(&session->key.kshare.kem_params);
                gnutls_pk_params_init(&session->key.kshare.kem_params);
@@ -739,6 +742,7 @@ static int client_use_key_share_single(gnutls_session_t session,
 
                return 0;
 
+       case GNUTLS_PK_MLKEM768:
        case GNUTLS_PK_EXP_KYBER768: {
                if (KYBER768_CIPHERTEXT_SIZE > buffer->length)
                        return gnutls_assert_val(

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 02794ee61c5f127324c7d607bf23911911932465..8b3bb5213130ef25c43988c5020e0f66b7d04ac6 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -1144,9 +1144,11 @@ typedef enum {
        GNUTLS_GROUP_MAX = GNUTLS_GROUP_FFDHE6144,
 
        /* Experimental algorithms */
-       GNUTLS_GROUP_EXP_MIN = 512,
-       GNUTLS_GROUP_EXP_X25519_KYBER768 = GNUTLS_GROUP_EXP_MIN,
-       GNUTLS_GROUP_EXP_MAX = GNUTLS_GROUP_EXP_X25519_KYBER768
+       GNUTLS_GROUP_EXP_X25519_KYBER768 = 512,
+       GNUTLS_GROUP_EXP_SECP256R1_MLKEM768 = 513,
+       GNUTLS_GROUP_EXP_X25519_MLKEM768 = 514,
+       GNUTLS_GROUP_EXP_MIN = GNUTLS_GROUP_EXP_X25519_KYBER768,
+       GNUTLS_GROUP_EXP_MAX = GNUTLS_GROUP_EXP_X25519_MLKEM768
 } gnutls_group_t;
 
 /* macros to allow specifying a specific curve in gnutls_privkey_generate()