CMS: Add support for hashless signing schemes (ML/SLH-DSA & EdDSA) for no-attributes case by stefanberger · Pull Request #28923 · openssl/openssl

stefanberger · 2025-10-15T18:40:53Z

Add support for hashless signing schemes, such as ML-DSA, SLH-DSA, and EdDSA, for the case that signed attributes are absent. Add test cases for all newly supported signing schemes.

Enable the ability to sign (verify) with a hashless signing schemes, such as ML-DSA in pure mode, in case no attributes are used in CMS. To support this, pass the BIO with the plain data through to the signing (verification) function so that key's pure mode signing scheme can hash the data itself.

The current implementation relies on a seek'able BIO so that the data stream can be read multiple times for support of multiple keys.

Some signing schemes, such as ML-DSA, support the message_update function when signing data, others, such as EdDSA keys do not support it. The former allows for reading data in smaller chunks and calling EVP_PKEY_sign_message_update() with the data, while the latter requires that all data are all read into memory and then passed for signing. This latter method could run into out-of-memory issue when signing very large files.

Fixes #11915
Fixes #13523 (?)
Fixes #28279

Checklist

documentation is added or updated
tests are added or updated

stefanberger · 2025-10-15T20:50:11Z

@DDvO @danvangeest FYI

jogme · 2025-10-16T06:31:58Z

would you please sign a CLA? https://openssl-library.org/policies/cla/

DDvO · 2025-10-16T06:46:30Z

Very nice!
Looks like this will make large part of #22391 obsolete,
which was for EdDSA only, while also trying to cover the legacy PKCS#7 implementation.

DDvO

I likely won't have the time for a full review in the next two weeks,
but here are some name/style-wise improvement suggestions at API level.

stefanberger · 2025-10-16T12:42:27Z

Very nice!
Looks like this will make large part of #22391 obsolete,
which was for EdDSA only, while also trying to cover the legacy PKCS#7 implementation.

I saw that some CMS-related tests were already working for the key types I am extending it for in this PR, but the non-attributes case was not covered. I am not sure what to do about PKCS#7...

One concern I have with the implementation is the BIO of the input data. I am wondering whether to make a copy of the data since the data may have to be read multiple times (for multiple keys in pure mode), even though this may cause issues with very large files but then on the other hand would improve performance.

DDvO

Thank you for very swiftly picking up my API suggestions and for adding doc entries.
For now, just spotted some doc nits.

Since this PR also documents the pre-existing functions CMS_dataFinal() and CMS_SignerInfo_verify_content(), you can (well, even should) remove them from util/missingcrypto.txt.

This extension is clearly worth an entry in NEWS.md.

Copilot

Pull Request Overview

This PR adds support for hashless signing schemes (ML-DSA, SLH-DSA, and EdDSA) in CMS when no signed attributes are present. The implementation enables these schemes to directly sign raw data instead of pre-computed hashes by passing the original data BIO through to signing and verification functions.

Key changes:

Added new public APIs CMS_dataFinal_hashless() and CMS_SignerInfo_verify_hashless() to support hashless signing schemes
Modified internal signing/verification functions to handle both hash-based and hashless signing schemes
Added comprehensive test coverage for EdDSA (Ed25519, Ed448), ML-DSA-44, and SLH-DSA-SHAKE-256s with the -noattr flag

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
util/libcrypto.num	Exports new public API functions for hashless signing support
test/recipes/80-test_cms.t	Adds test cases for hashless signing schemes (EdDSA, ML-DSA, SLH-DSA) with `-noattr`
include/openssl/cms.h.in	Declares new public APIs for hashless signing and verification
doc/man3/CMS_verify.pod	Documents the new verification functions for hashless schemes
doc/man3/CMS_final.pod	Documents the new finalization functions for hashless schemes
crypto/cms/cms_smime.c	Updates high-level CMS functions to use hashless variants
crypto/cms/cms_sd.c	Implements core hashless signing/verification logic with algorithm-specific handling
crypto/cms/cms_local.h	Updates internal function signatures to support data BIO parameter
crypto/cms/cms_lib.c	Implements new public APIs and updates internal routing

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

DDvO · 2025-10-16T17:19:09Z

There was no direct button for triggering the Copilot/AI review bot for some reason
(I guess this is not enabled for PRs from OpenSSL-external people),
but the option was still available for me via the cog wheel above the list of reviewers.

DDvO · 2025-10-16T17:28:04Z

Please add to the message of the respective commit this line:
Fixes #11915
And if correct (I'm not sure):
Fixes #13523

DDvO · 2025-10-16T17:29:47Z

CI failures are relevant; please check and fix issues.

igus68 · 2025-10-17T13:00:47Z

Hi Stefan,
Thanks a lot for the fantastic work! I have only some small remarks that I posted as comments to the code.
Your pull request also fixes issue #28279, so could you please add
Fixes #28279
as well

DDvO

Two hints how to get rid of the doc-nits CI failure.

Again, since this PR also documents the pre-existing functions CMS_dataFinal() and CMS_SignerInfo_verify_content(), should remove them from util/missingcrypto.txt

And comments regarding minor improvements on the coding style.

DDvO · 2025-10-17T16:00:55Z

 CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
                                X509 *signer, EVP_PKEY *pk, const EVP_MD *md,
                                unsigned int flags)
 {


BTW, the only remaining coding style issue reported by the CI is:

crypto/cms/cms_sd.c:421:function body length = 206 > 200 lines:CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,

While this PR already downsizes the function body a little bit,
there would be good chances by tweaking some other parts in here to get below the given "limit" ;-)

Is removing empty lines allowed?

You can ignore this issue.

t8m · 2025-10-17T17:58:11Z

The check docs and pre-commit failures are relevant.

…gning) Enable signature verification for hashless signing schemes, such as ML-DSA and EdDSA, for the non-attribute case of CMS. Also in this case the BIO with the plain input data needs to be passed through to the signature verification function so that the pure-mode signature verification method can hash the plain data itself. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Add CMS test cases for no-attribute signing for ML-DSA, SLH-DSA amd EdDSA (Ed448 and Ed25519 keys). Fixes: openssl#11915 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Implement EVP_SIGNATURE_hash_message_update() to check for support of EVP_PKEY_sign_message_update() and EVP_PKEY_verify_message_update() and use this function to replace the has_msg_update column in CMS. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

beldmit

LGTM

openssl-machine · 2025-11-14T13:01:22Z

This pull request is ready to merge

t8m · 2025-11-18T17:04:44Z

Merged to the master branch. Thank you for your contribution.

Get a default hash for hash-less signing schemes such as ML-DSA, SLH-DSA, and EdDSA in the case when signed attributes are present as well as for the no signed attributes case. For the latter case, EdDSA is the only signing scheme that has a required hash (sha512 for ED25519 and shake256 for ED448), all other ones have a suggested hash. Only use the suggested hash if the hash provided by the caller of CMS_add1_signer passed a NULL pointer for md. Use the required hash in any case, overriding any choice of the caller. Fixes: #13523 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28923)

Enable the ability to sign with a hashless signing schemes, such as ML-DSA in pure mode, in case no attributes are used in CMS. To support this, pass the BIO with the plain data through to the signing function so that key's pure mode signing scheme can hash the data itself. The current implementation relies on a seek'able BIO so that the data stream can be read multiple times for support of multiple keys. Some signing schemes, such as ML-DSA, support the message_update function when signing data, others, such as EdDSA keys do not support it. The former allows for reading data in smaller chunks and calling EVP_PKEY_sign_message_update with the data, while the latter requires that all data are all read into memory and then passed for signing. This latter method could run into out-of-memory issue when signing very large files. Fixes: #28279 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28923)

…gning) Enable signature verification for hashless signing schemes, such as ML-DSA and EdDSA, for the non-attribute case of CMS. Also in this case the BIO with the plain input data needs to be passed through to the signature verification function so that the pure-mode signature verification method can hash the plain data itself. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28923)

Add CMS test cases for no-attribute signing for ML-DSA, SLH-DSA amd EdDSA (Ed448 and Ed25519 keys). Fixes: #11915 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28923)

Implement EVP_SIGNATURE_hash_message_update() to check for support of EVP_PKEY_sign_message_update() and EVP_PKEY_verify_message_update() and use this function to replace the has_msg_update column in CMS. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28923)

Allow ML-DSA module signing to be enabled. Note that OpenSSL's CMS_*() function suite does not, as of OpenSSL-3.6, support the use of CMS_NOATTR with ML-DSA, so the prohibition against using signedAttrs with module signing has to be removed. The selected digest then applies only to the algorithm used to calculate the digest stored in the messageDigest attribute. The OpenSSL development branch has patches applied that fix this[1], but it appears that that will only be available in OpenSSL-4. [1] openssl/openssl#28923 sign-file won't set CMS_NOATTR if openssl is earlier than v4, resulting in the use of signed attributes. The ML-DSA algorithm takes the raw data to be signed without regard to what digest algorithm is specified in the CMS message. The CMS specified digest algorithm is ignored unless signedAttrs are used; in such a case, only SHA512 is permitted. Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Eric Biggers <ebiggers@kernel.org> cc: Lukas Wunner <lukas@wunner.de> cc: Ignat Korchagin <ignat@cloudflare.com> cc: Stephan Mueller <smueller@chronox.de> cc: Herbert Xu <herbert@gondor.apana.org.au> cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org

Allow ML-DSA module signing to be enabled. Note that OpenSSL's CMS_*() function suite does not, as of OpenSSL-3.6, support the use of CMS_NOATTR with ML-DSA, so the prohibition against using signedAttrs with module signing has to be removed. The selected digest then applies only to the algorithm used to calculate the digest stored in the messageDigest attribute. The OpenSSL development branch has patches applied that fix this[1], but it appears that that will only be available in OpenSSL-4. [1] openssl/openssl#28923 sign-file won't set CMS_NOATTR if openssl is earlier than v4, resulting in the use of signed attributes. The ML-DSA algorithm takes the raw data to be signed without regard to what digest algorithm is specified in the CMS message. The CMS specified digest algorithm is ignored unless signedAttrs are used; in such a case, only SHA512 is permitted. Signed-off-by: David Howells <dhowells@redhat.com> cc: Jarkko Sakkinen <jarkko@kernel.org> cc: Eric Biggers <ebiggers@kernel.org> cc: Lukas Wunner <lukas@wunner.de> cc: Ignat Korchagin <ignat@cloudflare.com> cc: Stephan Mueller <smueller@chronox.de> cc: Herbert Xu <herbert@gondor.apana.org.au> cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org

Get a default hash for hash-less signing schemes such as ML-DSA, SLH-DSA, and EdDSA in the case when signed attributes are present as well as for the no signed attributes case. For the latter case, EdDSA is the only signing scheme that has a required hash (sha512 for ED25519 and shake256 for ED448), all other ones have a suggested hash. Only use the suggested hash if the hash provided by the caller of CMS_add1_signer passed a NULL pointer for md. Use the required hash in any case, overriding any choice of the caller. Fixes: #13523 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from openssl/openssl#28923)

openssl-machine added the hold: cla required The contributor needs to submit a license agreement label Oct 15, 2025

DDvO requested changes Oct 16, 2025

View reviewed changes

Comment thread crypto/cms/cms_lib.c Outdated

Comment thread crypto/cms/cms_lib.c Outdated

Comment thread crypto/cms/cms_sd.c Outdated

DDvO reviewed Oct 16, 2025

View reviewed changes

Comment thread crypto/cms/cms_sd.c Outdated

stefanberger force-pushed the cms_mldsa branch from 80e45d0 to 3b0423e Compare October 16, 2025 16:09

t8m added approval: review pending This pull request needs review by a committer branch: master Applies to master branch triaged: feature The issue/pr requests/adds a feature tests: present The PR has suitable tests present labels Oct 16, 2025

stefanberger force-pushed the cms_mldsa branch from 3b0423e to 771b240 Compare October 16, 2025 16:42

github-actions Bot added the severity: ABI change This pull request contains ABI changes label Oct 16, 2025

DDvO requested changes Oct 16, 2025

View reviewed changes

DDvO requested a review from Copilot October 16, 2025 17:16

Copilot AI reviewed Oct 16, 2025

View reviewed changes

Comment thread doc/man3/CMS_verify.pod Outdated

Comment thread doc/man3/CMS_final.pod Outdated

Comment thread crypto/cms/cms_sd.c Outdated

Comment thread crypto/cms/cms_sd.c Outdated

Comment thread crypto/cms/cms_sd.c Outdated

stefanberger force-pushed the cms_mldsa branch from 771b240 to 59f1706 Compare October 16, 2025 18:23

igus68 reviewed Oct 17, 2025

View reviewed changes

Comment thread crypto/cms/cms_sd.c

Comment thread crypto/cms/cms_sd.c Outdated

Comment thread crypto/cms/cms_sd.c Outdated

igus68 reviewed Oct 17, 2025

View reviewed changes

Comment thread crypto/cms/cms_sd.c Outdated

DDvO mentioned this pull request Oct 17, 2025

Cannot call cms sign with MLDSA keys #28279

Closed

DDvO requested changes Oct 17, 2025

View reviewed changes

stefanberger force-pushed the cms_mldsa branch from 59f1706 to 746619f Compare October 17, 2025 16:23

openssl-machine removed the hold: cla required The contributor needs to submit a license agreement label Oct 17, 2025

stefanberger force-pushed the cms_mldsa branch from 746619f to a961417 Compare October 17, 2025 20:00

stefanberger added 3 commits November 7, 2025 08:22

tests: Add CMS tests for no-attribute signing for ML/SLH-DSA and EdDSA

bd567d9

Add CMS test cases for no-attribute signing for ML-DSA, SLH-DSA amd EdDSA (Ed448 and Ed25519 keys). Fixes: openssl#11915 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

stefanberger force-pushed the cms_mldsa branch from 73c47f1 to b82fa0b Compare November 7, 2025 14:23

t8m approved these changes Nov 7, 2025

View reviewed changes

beldmit approved these changes Nov 13, 2025

View reviewed changes

beldmit added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Nov 13, 2025

openssl-machine added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Nov 14, 2025

t8m closed this Nov 18, 2025

stefanberger deleted the cms_mldsa branch November 18, 2025 17:12

This was referenced Jan 27, 2026

Clean up CMS code by removing multi-shot EVP sign and verify calls #29807

Open

CMS and PKCS7: add support for EdDSA with curves 25519 and 448 #22391

Closed

This was referenced Mar 6, 2026

cms: Fix no-signed-attributes for unknown hashless algorithms #30287

Closed

CMS regression: signed attributes with ED448 #30291

Open

esyr mentioned this pull request Apr 14, 2026

[4.0] CHANGES.md: updates for 4.0.0 final release #30817

Closed

idrassi mentioned this pull request Jun 7, 2026

cms: reject Ed448 signedAttrs when digest is unavailable #31409

Open

1 task

Uh oh!

Uh oh!

Conversation

stefanberger commented Oct 15, 2025 • edited by DDvO Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

stefanberger commented Oct 15, 2025

Uh oh!

jogme commented Oct 16, 2025

Uh oh!

DDvO commented Oct 16, 2025

Uh oh!

DDvO left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stefanberger commented Oct 16, 2025

Uh oh!

DDvO left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DDvO commented Oct 16, 2025

Uh oh!

DDvO commented Oct 16, 2025

Uh oh!

DDvO commented Oct 16, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

igus68 commented Oct 17, 2025

Uh oh!

Uh oh!

DDvO left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DDvO Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

stefanberger Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

t8m Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

t8m commented Oct 17, 2025

Uh oh!

beldmit left a comment

Choose a reason for hiding this comment

Uh oh!

openssl-machine commented Nov 14, 2025

Uh oh!

t8m commented Nov 18, 2025

stefanberger commented Oct 15, 2025 •

edited by DDvO

Loading

DDvO left a comment •

edited

Loading

DDvO left a comment •

edited

Loading

DDvO left a comment •

edited

Loading