KBS Protocol | Add PQC algorithm support - Prototype/iss 1271#1383
KBS Protocol | Add PQC algorithm support - Prototype/iss 1271#1383grant-arqit wants to merge 18 commits into
Conversation
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
…nctions. Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
…serialiation friendly value for tee_putkey while main TeePubKey type doesn not include new AKP value. Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
…imental now gated in guest-components. Trustee will accept classic and defined PQC types from guest-components. Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
|
Latest commits integrate updated kbs-types definition for TeePubKey implemented in PR 87. The feature gating for processing PQC worklows is driven by changes in guest-components now. This change will encrypt responses based on any of the TeePubKey types defined in the updated kbs-types |
Xynnn007
left a comment
Xynnn007
left a comment
There was a problem hiding this comment.
Some more ideas;
About the algorithm implementation, only one question (not blocker) is about scheme candidate.
More ideas are about code organization
| pub const AKP_KTY: &str = "AKP"; | ||
|
|
||
| /// Algorithm identifier for ML-KEM-768 with AES-192 key wrap. | ||
| pub const ML_KEM_768_A192KW_ALGORITHM: &str = "ML-KEM-768+A192KW"; |
There was a problem hiding this comment.
Just out of curiosity: why not use MLKEM1024+A256KW?
There was a problem hiding this comment.
There was no technical reason for this. It's the default for TLS Hybrid and while MLKEM1024+A256KW provides higher assurance ML-KEM-768 which is tied to AES-192 for the key wrap should be adequate for general use. Let me know if you think otherwise.
There was a problem hiding this comment.
no strong preference. I assumed that there is some hidden rules, but looks like no. Probably we need some comments upon the algorithm to help newbie like me to understand the reason?
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
Xynnn007
left a comment
Xynnn007
left a comment
There was a problem hiding this comment.
Last comments from my side. Others LGTM!
Signed-off-by: Grant Nunn <grant.nunn@arqit.uk>
2 participants
This is the initial draft implementation to enable PQC algorithm support across CoCo. These changes reflect those required on the Trustee side, and is enabled via a compile time feature flag.