Skip to content

Conversation

@mamckee
Copy link
Collaborator

@mamckee mamckee commented Nov 25, 2025

This PR updates the SymCrypt provider ML-KEM and ML-KEM hybrid to match the behavior of the OpenSSL default provider implementation, added in OpenSSL 3.5. This PR also fixes minor bugs and behavior differences found when testing the SymCrypt provider with OpenSSL 3.5's new ML-KEM tests.

  • Different ML-KEM parameter sets, and hybrid algorithms are now registered as their own algorithm for key management, KEM, encode, and decode.
  • Split ML-KEM hybrid into its own key management and KEM interfaces to better match OpenSSL's behavior and for maintainability.
  • Removed ML-KEM hybrid encoder and decoders since they don't exist in OpenSSL 3.5 and are based on test OIDS.

@qmuntal
Copy link
Member

qmuntal commented Nov 25, 2025

FYI We recently added support for MLKEM to https://github.com/golang-fips/openssl, so you can use it to test that you will be at least compatible with the Microsoft build of Go. #Resolved

@samuel-lee-msft
Copy link
Contributor

samuel-lee-msft commented Jan 10, 2026

return SCOSSL_SUCCESS;

Also should be return ret? #Resolved


Refers to: SymCryptProvider/src/keymgmt/p_scossl_mlkem_keymgmt.c:899 in 66b665e. [](commit_id = 66b665e, deletion_comment = False)

Copy link
Contributor

@samuel-lee-msft samuel-lee-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo feedback!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants