You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Nobody's working on DSA. You can go for it. Edit: implemented!
It might be good to come up with a plan for how it would be implemented (e.g. what crate dependencies would be used, for example), and ideally try to align with https://github.com/RustCrypto/RSA on some of those decisions
GOST digital signature alsorithm is missing. However additional care should be taken while implementing it. The standard is clueless with respect to endianness of the used numbers. The implementation should follow the established practice, rather than blindly following the standard.
Compiling ed25519 v1.3.0 (https://github.com/RustCrypto/signatures.git?tag=ed25519/v1.3.0#8282fcaf)
error[E0405]: cannot find trait Signature in crate signature
--> /home/ami/.cargo/git/checkouts/signatures-a6df6df1cc32e789/8282fca/ed25519/src/lib.rs:349:17
|
349 | impl signature::Signature for Signature {
| ^^^^^^^^^ not found in signature
For more information about this error, try rustc --explain E0405.
error: could not compile ed25519 (lib) due to previous error
warning: build failed, waiting for other jobs to finish...
Hey @cothan, happy to collaborate on ML-DSA. Especially if you're willing to take the lead :) I haven't looked at ML-DSA much, but my impression is that the algebra is similar to ML-KEM, but the constants are different, as are which bits are public/private. So you'll probably want to change some things, but hopefully the ml-kem crate has good framework to adapt.
Ideally I'd hope there can be some reuse / shared code between ml-kem and ml-dsa, but I'm not sure the best way to structure that, especially since they're split across repos
The part I would have the most hope for is the linear algebra bits (algebra.rs in ml-kem), since those seem pretty much the same aside from the prime in use. Even then, you would have to make these operations generic over the prime, and probably over the storage class as well -- the ML-KEM prime fits in 12 bits, while the ML-DSA prime requires 24 bits.
The question beyond that is: what variant of Schnorr? EdDSA is the most popular one in modern use. Other than that, BIP340 is the only other modern specification I'm aware of.
Oh, missed BIP340 in k256. I think we could implement that generically, over any curve with a prime number of points (unlike edwards curves, for which EdDSA exist). Don't know if that generic exists though.
@cothan, bit late to the party but would also be interested in helping out with ML-DSA. Any chance I could be added to your repo to lend a hand to anything?
Hi Rust Crypto Team, I am wondering if you are willing to accept PQC - NIST FIPS 203,204 and Falcon and Spincs+ into the Crypto Ecosystem. From the email conversation, I realized that y'all already have FIPS 203,204 and Spincs+, is Falcon open to implement?
It is still in works with SIMD and chip-level optimization in place, I was wondering if y'all are still open to take in community based repositories to allow for easier access to PQC Algorithms to be used.
Given that, it probably doesn't make sense for us to have a separate implementation (similar to how we don't have a BLAKE3 implementation, for example)
Given that is case, are there any upcoming algorithms that y'all plan on implementing, somewhere to contribute in, I do have SM9 and researching on GOST but I am not sure if yor are willing to integrate it to the ecosystem
I'm also interested in a FAEST implementation. It is not standardized by NIST, but has a tight security proof, which is one reason why I am interested in it.
Activity
link2xt commentedon Oct 20, 2019
DSA - Requested here: rpgp/rpgp#56
heisen-li commentedon Nov 3, 2020
Is DSA not implemented yet? I can try to add.
tarcieri commentedon Nov 3, 2020
Nobody's working on DSA. You can go for it.Edit: implemented!It might be good to come up with a plan for how it would be implemented (e.g. what crate dependencies would be used, for example), and ideally try to align with https://github.com/RustCrypto/RSA on some of those decisions
dsa: Add initial DSA implementation (#471)
lumag commentedon Jul 27, 2022
GOST digital signature alsorithm is missing. However additional care should be taken while implementing it. The standard is clueless with respect to endianness of the used numbers. The implementation should follow the established practice, rather than blindly following the standard.
adamvm commentedon Oct 12, 2023
During build automata with rust nightly:
Compiling ed25519 v1.3.0 (https://github.com/RustCrypto/signatures.git?tag=ed25519/v1.3.0#8282fcaf)
error[E0405]: cannot find trait
Signaturein cratesignature--> /home/ami/.cargo/git/checkouts/signatures-a6df6df1cc32e789/8282fca/ed25519/src/lib.rs:349:17
|
349 | impl signature::Signature for Signature {
| ^^^^^^^^^ not found in
signatureFor more information about this error, try
rustc --explain E0405.error: could not compile
ed25519(lib) due to previous errorwarning: build failed, waiting for other jobs to finish...
tarcieri commentedon Oct 12, 2023
nightlyis expected to break in ways that have nothing to do with our crates, nor can we do anything to fix themtarcieri commentedon Mar 4, 2024
A note about ML-DSA: we now have an ML-KEM implementation at https://github.com/RustCrypto/KEMs/tree/master/ml-kem
It would be good for an ML-DSA implementation to share a common core with
ml-kem.cothan commentedon Mar 6, 2024
Hi, I'm interested in implementing ML-DSA.
tarcieri commentedon Mar 6, 2024
cc @bifurcation
bifurcation commentedon Mar 6, 2024
Hey @cothan, happy to collaborate on ML-DSA. Especially if you're willing to take the lead :) I haven't looked at ML-DSA much, but my impression is that the algebra is similar to ML-KEM, but the constants are different, as are which bits are public/private. So you'll probably want to change some things, but hopefully the
ml-kemcrate has good framework to adapt.tarcieri commentedon Mar 6, 2024
Ideally I'd hope there can be some reuse / shared code between
ml-kemandml-dsa, but I'm not sure the best way to structure that, especially since they're split across reposbifurcation commentedon Mar 6, 2024
The part I would have the most hope for is the linear algebra bits (
algebra.rsinml-kem), since those seem pretty much the same aside from the prime in use. Even then, you would have to make these operations generic over the prime, and probably over the storage class as well -- the ML-KEM prime fits in 12 bits, while the ML-DSA prime requires 24 bits.15 remaining items
tarcieri commentedon Mar 30, 2024
We have an implementation of BIP340 Schnorr in the
k256crate.The question beyond that is: what variant of Schnorr? EdDSA is the most popular one in modern use. Other than that, BIP340 is the only other modern specification I'm aware of.
iquerejeta commentedon Mar 30, 2024
Oh, missed BIP340 in k256. I think we could implement that generically, over any curve with a prime number of points (unlike edwards curves, for which EdDSA exist). Don't know if that generic exists though.
tarcieri commentedon Mar 30, 2024
I would be wary to implement BIP340 for elliptic curves other than secp256k1. It's not really defined that way.
EdDSA is designed to be useful across multiple twisted Edwards curves, except @RustCrypto has no implementations of those.
supinie commentedon Jun 5, 2024
@cothan, bit late to the party but would also be interested in helping out with ML-DSA. Any chance I could be added to your repo to lend a hand to anything?
tarcieri commentedon Jun 5, 2024
It sure would be nice if people worked on ML-DSA in public forks. I have no idea what the status of @cothan's branch is.
cothan commentedon Jun 5, 2024
Hi @supinie , I send you invitation to my github repo. I will make the repo public at when some code has landed.
tarcieri commentedon Jul 11, 2024
FYI, I've published some initial crate boilerplate for
ml-dsahere: https://github.com/RustCrypto/signatures/tree/master/ml-dsaEdit: PR open with an implementation: #877
R1kaB3rN commentedon Feb 1, 2025
@newpavlov I believe we can close this issue as the implementations for ML-DSA and SLH-DSA have already been merged.
tarcieri commentedon Feb 1, 2025
I checked them off, but we can leave the issue open for future requests
lumag commentedon Feb 1, 2025
Well... Do we have SM9, GOST-01/12 and other strange stuff?
Pierre-Aronnax commentedon Feb 25, 2025
Hi Rust Crypto Team, I am wondering if you are willing to accept PQC - NIST FIPS 203,204 and Falcon and Spincs+ into the Crypto Ecosystem. From the email conversation, I realized that y'all already have FIPS 203,204 and Spincs+, is Falcon open to implement?
It is still in works with SIMD and chip-level optimization in place, I was wondering if y'all are still open to take in community based repositories to allow for easier access to PQC Algorithms to be used.
tarcieri commentedon Feb 26, 2025
There's an existing Rust implementation of Falcon by one of the algorithm's designers (@pornin): https://github.com/pornin/rust-fn-dsa
Given that, it probably doesn't make sense for us to have a separate implementation (similar to how we don't have a BLAKE3 implementation, for example)
Pierre-Aronnax commentedon Feb 26, 2025
Given that is case, are there any upcoming algorithms that y'all plan on implementing, somewhere to contribute in, I do have SM9 and researching on GOST but I am not sure if yor are willing to integrate it to the ecosystem
gkgoat1 commentedon Aug 11, 2025
I'm interested in a pure-Rust version of SQISign.
gkgoat1 commentedon Aug 24, 2025
I'm also interested in a FAEST implementation. It is not standardized by NIST, but has a tight security proof, which is one reason why I am interested in it.