Skip to content

Add ML-KEM and ML-DSA to well-known OID lookups#131289

Merged
vcsjones merged 1 commit into
dotnet:mainfrom
vcsjones:wellknown-oid-pqc
Jul 24, 2026
Merged

Add ML-KEM and ML-DSA to well-known OID lookups#131289
vcsjones merged 1 commit into
dotnet:mainfrom
vcsjones:wellknown-oid-pqc

Conversation

@vcsjones

@vcsjones vcsjones commented Jul 23, 2026

Copy link
Copy Markdown
Member

This adds ML-KEM and ML-DSA to the well-known OID lookup. The evidence of needing these in the well-known lookups is as such

  1. the S/MIME CA/B working group approved PQC algorithms, ML-DSA and ML-KEM in ballot SMC013. Sections 7.1.3.2.4 and 7.1.3.2.5 of the requirements enable the use of these. HashML-DSA is explicitly excluded.

  2. The Server Cert working group does not have as much progress here but the current draft proposal indicates ML-DSA-44 ML-DSA-87 as a start.

  3. The Code Signing Working Group has largely only looked at ML-DSA-87. The most I was able to glean thus far is from their meeting minutes

    LMS was discussed but discouraged by Microsoft due to its complexity and state management challenges. SLH-DSA and hash-MLDSA were mentioned as less desirable or redundant. Microsoft confirmed support for MLDSA 87 and plans for additional parameter sets, but expressed reservations about LMS.

Given the discussion so far, I left out SLH-DSA so far as there seems to be no interest in adopting it just yet, so it doesn't need a fast path. Likewise for the HashML-DSA parameters. CompositeML-DSA may be added later as specifications ramp up and start using it, but right now it seems lacking to me.

@vcsjones
vcsjones requested a review from bartonjs July 23, 2026 20:11
@vcsjones vcsjones self-assigned this Jul 23, 2026
Copilot AI review requested due to automatic review settings July 23, 2026 20:11
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/area-system-formats-asn1, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds additional post-quantum algorithm OIDs (ML-DSA parameter sets and ML-KEM parameter sets) to System.Formats.Asn1’s internal well-known OID tables so AsnWriter / AsnDecoder can use the fast-path mapping for these identifiers.

Changes:

  • Extended WellKnownOids.GetValue / WellKnownOids.GetContents to include ML-DSA (44/65/87) and ML-KEM (512/768/1024) OIDs.
  • Updated the packed data table and adjusted slice offsets to include the new entries.
  • Added/extended OID reader/writer tests with the new OID values.
Show a summary per file
File Description
src/libraries/System.Formats.Asn1/src/System/Formats/Asn1/WellKnownOids.cs Adds ML-DSA / ML-KEM OIDs to the internal well-known mapping tables (bytes↔string) and updates slice offsets.
src/libraries/System.Formats.Asn1/tests/Writer/WriteObjectIdentifier.cs Extends writer test data with the new OID strings and expected encodings.
src/libraries/System.Formats.Asn1/tests/Reader/ReadObjectIdentifier.cs Adds a decoder test case set for the new OID encodings.

Copilot's findings

  • Files reviewed: 3/3 changed files
  • Comments generated: 1

@vcsjones
vcsjones enabled auto-merge (squash) July 23, 2026 21:15
@vcsjones
vcsjones merged commit 4104e67 into dotnet:main Jul 24, 2026
91 of 97 checks passed
@vcsjones
vcsjones deleted the wellknown-oid-pqc branch July 24, 2026 03:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants