linux-kernel - Re: Python script to generate X509/CMS from NIST testcases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <10662580.0AQdONaE2F@tauon>
Date: Tue, 20 Jan 2026 16:42:47 +0100
From: Stephan Mueller <smueller@...onox.de>
To: Eric Biggers <ebiggers@...nel.org>, David Howells <dhowells@...hat.com>
Cc: dhowells@...hat.com, linux-crypto@...r.kernel.org,
 linux-kernel@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>,
 "Jason A . Donenfeld" <Jason@...c4.com>,
 Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: Python script to generate X509/CMS from NIST testcases

Am Dienstag, 20. Januar 2026, 16:04:15 Mitteleuropäische Normalzeit schrieb 
David Howells:

Hi David,

> Hi Eric, Stephan,
> 
> In case it turns out to be useful to you as a template, here's a script that
> I wrote to package NIST ML-DSA testcases from JSON files into rudimentary
> X.509, message and CMS signature files and also to produce a C file that
> contains those blobs packaged into u8 arrays with a table listing them all.
> 
> It also tries to verify each testcase with "openssl smime" - except that
> that doesn't work too will for ML-DSA (it did work for RSASSA-PSS, but
> that's another script).
> 

Thank you very much for this reference.

Also, in case it is useful for you as well: I just completed the work on 
adopting the sbsigntools to PQC [1]. This would support the adoption of the 
shim bootloader to use PQC algorithms that is started at [2]. The coding in 
[2] is completed to the extend that it compiles as PE/COFF executable. Now I 
am working through the testing and adopt it to use the updated sbsigntools.

[1] https://github.com/smuellerDD/leancrypto/tree/master/apps/src#secure-boot-signing-tools-supporting-pqc

[2] https://github.com/smuellerDD/shim/tree/leancrypto2

Ciao
Stephan