Add ML-DSA-87 DPE profile #66

jhand2 · 2025-08-29T22:41:48Z

Additionally, add a P384-SHA512 profile. This is to provide a classical profile whose measurement format is compatible with ML-DSA-87.

jhand2 · 2025-08-29T22:42:59Z

specifications/dpe-irot-profile/spec.ocp

@@ -1468,9 +1621,24 @@ Table: `SIGN_INPUT_ARGS` struct
 | 0x08            | `U32`         | 31:0     | `PROFILE`            | One of `DPE_PROFILE_IROT_SHA256_P256`.
 | 0x0C            | `BYTES`       | 127:0    | `CONTEXT_HANDLE`     | A numeric handle referring to a DPE context.
 | 0x1C            | `HASH`        |          | `LABEL`              | Digest measurement label used in key derivation.
-| 0x1C + H        | `BITFIELD`    | 31:0     | `RESERVED`           | Reserved
+| 0x1C + H        | `BITFIELD`    | 31       | `FULL_MESSAGE`       | If set, `TO_BE_SIGNED` contains the full message. This flag is only supported where explicitly specified in `to-be-signed-format`.


I'm not yet convinced this is the best way to do this, but I kinda like it because it doesn't break back compat with older profile revisions.

jhand2 · 2025-08-29T22:43:07Z

specifications/dpe-irot-profile/spec.ocp

+`H`          | Hash Size             | 64
+`P`          | Public Key Size       | 2592
+`S`          | Signature Size        | 4697
+`C`          | Certificate Size      | TODO


jhand2 · 2025-08-29T22:43:27Z

specifications/dpe-irot-profile/spec.ocp

@@ -1178,6 +1263,63 @@ The format “ocp.csr.irot-leaf.p384” is defined as follows:
 | supports-symmetric-sign       | False                                                            |
 +-------------------------------+------------------------------------------------------------------+

+### ocp.profile.irot.p384-sha512


Consider breaking this profile into a separate PR

Additionally, add a P384-SHA512 profile. This is to provide a classical profile whose measurement format is compatible with ML-DSA-87. Signed-off-by: Jordan Hand <[email protected]>

clundin25 · 2025-08-29T22:48:21Z

specifications/dpe-irot-profile/spec.ocp

+
+Names follow the format:
+
+`DPE_PROFILE_IROT{_OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`


Suggested change

`DPE_PROFILE_IROT{_OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`

`DPE_PROFILE_IROT_{OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`

What does "OPTIONAL" mean in this context?

clundin25 · 2025-08-29T22:54:15Z

specifications/dpe-irot-profile/spec.ocp

+*   Inputs
+    *   CDI
+    *   `LABEL`
+    *   ASCII Bytes "ECC"


Should the ASCII bytes be "ML-DSA"?

clundin25 · 2025-08-29T22:54:58Z

specifications/dpe-irot-profile/spec.ocp

+    *   `LABEL`
+    *   ASCII Bytes "ECC"
+*   Outputs
+    *   48-byte key


Should this be a 64 byte key?

clundin25 · 2025-08-29T22:55:40Z

specifications/dpe-irot-profile/spec.ocp

+The format “ocp.tbs-format.digest-sha384” is defined as
+
+*   A digest which will be signed directly using the signing scheme with no
+    additional processing. The size of the value SHALL be a SHA2-384 digest of
+    size 48 bytes.


Should this be SHA-512, not SHA-384?

clundin25 · 2025-08-29T22:58:08Z

specifications/dpe-irot-profile/spec.ocp

+-------------------------------+------------------------------------------------------------------+
+| ========================================= Signatures =========================================== |
+-------------------------------+------------------------------------------------------------------+
+| to-be-signed-format           | If Sign FULL_MESSAGE flag is set, ocp.format.mldsa87-external-mu.|


nit: Maybe specify Sign Command?

zhalvorsen · 2025-09-03T16:22:07Z

specifications/dpe-irot-profile/spec.ocp

+*   Inputs
+    *   CDI
+    *   `LABEL`
+    *   ASCII Bytes "ECC"


Suggested change

* ASCII Bytes "ECC"

* ASCII Bytes "MLDSA"

zhalvorsen · 2025-09-03T16:28:07Z

specifications/dpe-irot-profile/spec.ocp

+    *   `LABEL`
+    *   ASCII Bytes "ECC"
+*   Outputs
+    *   48-byte key


Suggested change

* 48-byte key

* 4896-byte key

zhalvorsen · 2025-09-03T16:29:04Z

specifications/dpe-irot-profile/spec.ocp

@@ -562,6 +593,29 @@ The format “ocp.tbs-format.digest-sha384” is defined as
    additional processing. The size of the value SHALL be a SHA2-384 digest of
    size 48 bytes.

+### ocp.tbs-format.digest-sha512
+
+The format “ocp.tbs-format.digest-sha384” is defined as


Suggested change

The format “ocp.tbs-format.digest-sha384” is defined as

The format “ocp.tbs-format.digest-sha512” is defined as

zhalvorsen · 2025-09-03T16:29:39Z

specifications/dpe-irot-profile/spec.ocp

+    additional processing. The size of the value SHALL be a SHA2-384 digest of
+    size 48 bytes.


Suggested change

additional processing. The size of the value SHALL be a SHA2-384 digest of

size 48 bytes.

additional processing. The size of the value SHALL be a SHA2-512 digest of

size 64 bytes.

zhalvorsen · 2025-09-03T16:32:56Z

specifications/dpe-irot-profile/spec.ocp

+-------------------------------+------------------------------------------------------------------+
+| name                          | ocp.profile.irot.ml-dsa-87                                       |
+-------------------------------+------------------------------------------------------------------+
+| inherits                      | ocp.profile.irot.p256                                            |


If we set this we can drop the input format section too

zhalvorsen · 2025-09-03T16:55:16Z

specifications/dpe-irot-profile/spec.ocp

+| 0x1C + H        | `BITFIELD`    | 31       | `FULL_MESSAGE`       | If set, `TO_BE_SIGNED` contains the full message. This flag is only supported where explicitly specified in `to-be-signed-format`.
+|                 |               | 30:0     | `RESERVED`           | Reserved
+| 0x20 + H        | `U32`         | 31:0     | `TO_BE_SIGNED_SIZE`  | Number of bytes populated in `TO_BE_SIGNED`
+| 0x20 + H        | `BYTES`       | 8191:0   | `TO_BE_SIGNED`       | Message to be signed.


jhand2 commented Aug 29, 2025

View reviewed changes

jhand2 marked this pull request as ready for review August 29, 2025 22:43

Add ML-DSA-87 DPE profile

55645dc

Additionally, add a P384-SHA512 profile. This is to provide a classical profile whose measurement format is compatible with ML-DSA-87. Signed-off-by: Jordan Hand <[email protected]>

jhand2 force-pushed the mldsa branch from 5d43050 to 55645dc Compare August 29, 2025 22:44

clundin25 reviewed Aug 29, 2025

View reviewed changes

specifications/dpe-irot-profile/spec.ocp

* Inputs

* CDI

* `LABEL`

* ASCII Bytes "ECC"

Copy link

clundin25 Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should the ASCII bytes be "ML-DSA"?

clundin25 reviewed Aug 29, 2025

View reviewed changes

specifications/dpe-irot-profile/spec.ocp

* `LABEL`

* ASCII Bytes "ECC"

* Outputs

* 48-byte key

Copy link

clundin25 Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be a 64 byte key?

clundin25 reviewed Aug 29, 2025

View reviewed changes

zhalvorsen reviewed Sep 3, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add ML-DSA-87 DPE profile #66

Add ML-DSA-87 DPE profile #66

Uh oh!

jhand2 commented Aug 29, 2025

Uh oh!

jhand2 Aug 29, 2025

Uh oh!

jhand2 Aug 29, 2025

Uh oh!

jhand2 Aug 29, 2025

Uh oh!

clundin25 Aug 29, 2025

Uh oh!

clundin25 Aug 29, 2025

Uh oh!

clundin25 Aug 29, 2025

Uh oh!

clundin25 Aug 29, 2025

Uh oh!

clundin25 Aug 29, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

zhalvorsen Sep 3, 2025

Uh oh!

Uh oh!


		Names follow the format:

		`DPE_PROFILE_IROT{_OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`

	`DPE_PROFILE_IROT{_OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`
	`DPE_PROFILE_IROT_{OPTIONAL_VARIANT}_{SIGNING_ALGORITHM}_{MEASUREMENT_DIGEST_ALGORITHM}`

	The format “ocp.tbs-format.digest-sha384” is defined as
	The format “ocp.tbs-format.digest-sha512” is defined as

		additional processing. The size of the value SHALL be a SHA2-384 digest of
		size 48 bytes.

	\| inherits \| ocp.profile.irot.p256 \|
	\| inherits \| ocp.profile.irot.p384-sha512 \|

	\| 0x20 + H \| `BYTES` \| 8191:0 \| `TO_BE_SIGNED` \| Message to be signed.
	\| 0x24 + H \| `BYTES` \| 8191:0 \| `TO_BE_SIGNED` \| Message to be signed.

Add ML-DSA-87 DPE profile #66

Are you sure you want to change the base?

Add ML-DSA-87 DPE profile #66

Uh oh!

Conversation

jhand2 commented Aug 29, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!