ML-DSA Pure Cert Support by stenslae · Pull Request #251 · wolfSSL/wolfCLU

stenslae · 2026-06-16T17:43:00Z

Self-signed certificate (CA) and CSR generation
CA-based certificate signing
Certificate verification
Includes updated documentation and test coverage for ML-DSA workflows

Notes:

X.509 extensions are currently not fully supported for ML-DSA
wolfssl-x509(1) -text cannot fully decode ML-DSA SubjectPublicKey

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-src
Failed targets: wolfclu-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

Copilot

Pull request overview

Copilot reviewed 33 out of 33 changed files in this pull request and generated 2 comments.

philljj

First pass.

philljj · 2026-07-09T17:16:56Z

    int    pemBufSz    = 0;
    int    outBufSz    = 0;

-#ifdef WOLFSSL_SMALL_STACK


Is it ok to remove the WOLFSSL_SMALL_STACK code here?

That was intentional, I opted to always heap-allocate the MLDSA key material due to size. Let me know if there's a better route to go for those.

philljj · 2026-07-09T17:44:19Z

@@ -0,0 +1,65 @@
+/* clu_mldsa.h
+ *
+ * Copyright (C) 2006-2025 wolfSSL Inc.


copyright year 2026

philljj · 2026-07-09T19:56:13Z

 iky6IRTUzkBy1fssv3Gr/jOsyN8J565NST3RpQ==
 -----END CERTIFICATE-----
 ```
+A self-signed certificate can also be generated with post-quantum ML-DSA (FIPS 204) key. `ml-dsa` and `dilithium` are interchangeable command aliases, and the level (`2`/`3`/`5`) selects ML-DSA-44/65/87. This needs wolfSSL built with `--enable-dilithium --enable-experimental`.


We will need to update enable-dilithium to enable-mldsa, but that can be in a separate PR.

philljj · 2026-07-09T20:10:17Z

@@ -0,0 +1,1890 @@
+/* clu_mldsa.c
+ *
+ * Copyright (C) 2006-2025 wolfSSL Inc.


philljj · 2026-07-09T20:28:20Z

    if (ret == NULL) {
+        /* every error path above sets conf=NULL after
+         * calling wolfCLU_CertSignFree */
        wolfSSL_NCONF_free(conf);


It looks like wolfCLU_CertSignFree(ret) is called on every error, and it does

if (csign->config != NULL) { wolfSSL_NCONF_free(csign->config); csign->config = NULL; }

So this code should not be calling wolfSSL_NCONF_free(conf); at all here? Or it could risk a double free.

Yes, that call was redundant. I removed it at the bottom.

philljj · 2026-07-09T21:08:11Z

        }

+#ifdef WOLFCLU_MLDSA_CERTGEN
+        if (ret == WOLFCLU_SUCCESS && !isMLDSA &&


Why is this guarded by !isMLDSA if this codeblock is for ML-DSA?

The isMLDSA flag indicates that an existing ML-DSA key was passed in via the -key argument. The block is guarded with !isMLDSA so that if the user provides an existing key, a new key doesn't get generated.

philljj · 2026-07-09T21:13:10Z

+                    rngInited = 1;
+                }
+
+                /* Pick a random temp file path for throwaway key. */


Why would there be temp files and temp keys for certificate generation?

-newkey ml-dsa was writing the freshly generated key to a randomly-named temp file on disk just so it could immediately be read back into an MlDsaKey, then deleted, but it was easier to do in in memory, so I updated that

preferably we shouldn't write key material to disk other than what the user requested. Even tmp files can have nasty surprises for sensitive material. E.g. the OS could unlink the file, but not actually zero the sensitive data.

Good point, I'm working on updating that and will get it in on Monday. There were also a few other gaps in this pr.

philljj · 2026-07-09T21:15:40Z

 #include <wolfclu/pkey/clu_pkey.h>
 #include <wolfclu/certgen/clu_certgen.h>

+#ifndef WOLFCLU_NO_FILESYSTEM


Was this filesystem block necessary because you need to do file operations here and can't rely on wolfSSL wolfSSL_PEM_read_bio_PrivateKey (which doesn't support ML-DSA)?

There are probably other wolfssl or wolfcrypt functions we can use to avoid the need for file ops here.

No, it was needed to support the above file operations.

added ml-dsa pure self signed

7873126

stenslae requested a review from wolfSSL-Fenrir-bot June 16, 2026 17:43

stenslae self-assigned this Jun 16, 2026

stenslae force-pushed the ml-dsa-cert branch from 009fb30 to 8e28b3e Compare June 16, 2026 17:51

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

Comment thread src/sign-verify/clu_x509_verify.c Outdated

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/sign-verify/clu_x509_verify.c Outdated

stenslae force-pushed the ml-dsa-cert branch 2 times, most recently from 7b1ecb7 to 915636c Compare June 16, 2026 20:12

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot June 16, 2026 20:13

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c

Comment thread src/x509/clu_mldsa.c

Comment thread src/x509/clu_mldsa.c Outdated

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c

stenslae force-pushed the ml-dsa-cert branch from 915636c to eee645f Compare June 16, 2026 21:00

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot June 16, 2026 21:02

stenslae force-pushed the ml-dsa-cert branch from eee645f to b6cdbf8 Compare June 16, 2026 21:07

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

Comment thread src/sign-verify/clu_x509_verify.c Outdated

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/sign-verify/clu_x509_verify.c Outdated

stenslae force-pushed the ml-dsa-cert branch from b6cdbf8 to 7cc2fd5 Compare June 16, 2026 21:55

stenslae requested a review from wolfSSL-Fenrir-bot June 16, 2026 21:55

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread src/sign-verify/clu_x509_verify.c Outdated

Comment thread src/x509/clu_mldsa.c Outdated

stenslae commented Jun 16, 2026

View reviewed changes

Comment thread src/sign-verify/clu_x509_verify.c Outdated

stenslae force-pushed the ml-dsa-cert branch from 7cc2fd5 to cdaafd1 Compare June 16, 2026 23:00

stenslae commented Jun 17, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

stenslae force-pushed the ml-dsa-cert branch from cdaafd1 to 5604d46 Compare June 17, 2026 17:18

stenslae requested a review from wolfSSL-Fenrir-bot June 17, 2026 17:18

wolfSSL-Fenrir-bot reviewed Jun 17, 2026

View reviewed changes

stenslae assigned cconlon Jun 17, 2026

stenslae requested a review from wolfSSL-Fenrir-bot June 29, 2026 17:18

stenslae force-pushed the ml-dsa-cert branch from c535a60 to e3844b4 Compare June 29, 2026 17:43

wolfSSL-Fenrir-bot reviewed Jun 29, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c

Comment thread src/x509/clu_request_setup.c

stenslae commented Jun 29, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c

stenslae commented Jun 29, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c

stenslae force-pushed the ml-dsa-cert branch from e3844b4 to 916d34e Compare June 29, 2026 22:08

stenslae requested a review from wolfSSL-Fenrir-bot June 29, 2026 22:08

wolfSSL-Fenrir-bot reviewed Jun 29, 2026

View reviewed changes

stenslae force-pushed the ml-dsa-cert branch from 916d34e to f5a50f4 Compare June 29, 2026 22:26

stenslae requested a review from wolfSSL-Fenrir-bot June 29, 2026 22:26

wolfSSL-Fenrir-bot reviewed Jun 29, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c

stenslae commented Jun 29, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c

stenslae force-pushed the ml-dsa-cert branch from f5a50f4 to 757f8ed Compare June 29, 2026 22:56

support for mldsa - csrs, ca signing and verifying

48589af

stenslae force-pushed the ml-dsa-cert branch from 757f8ed to 48589af Compare June 29, 2026 22:57

stenslae requested a review from wolfSSL-Fenrir-bot June 29, 2026 22:58

wolfSSL-Fenrir-bot reviewed Jun 29, 2026

View reviewed changes

stenslae requested a review from cconlon June 30, 2026 15:17

stenslae assigned cconlon Jul 7, 2026

dgarske assigned wolfSSL-Bot and philljj and unassigned cconlon and stenslae Jul 7, 2026

dgarske requested a review from philljj July 7, 2026 21:40

philljj requested a review from Copilot July 9, 2026 17:12

Copilot started reviewing on behalf of philljj July 9, 2026 17:16 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread src/x509/clu_x509_sign.c

Comment thread src/sign-verify/clu_x509_verify.c

philljj requested changes Jul 9, 2026

View reviewed changes

philljj assigned stenslae and unassigned wolfSSL-Bot Jul 9, 2026

Uh oh!

Conversation

stenslae commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #251

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stenslae Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stenslae commented Jun 16, 2026 •

edited

Loading

stenslae Jul 9, 2026 •

edited

Loading