linzer 0.8.0 → 0.8.1.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47932906cedb5dd66d7d2bbc5e8eaac9f01b4e17dd7089bc87b4a06b9505b366
-  data.tar.gz: abe9bf21ac6d66a08f229de3fb10e77bc911c112f812cd0cf620d9f3947d580e
+  metadata.gz: ced6e7bed237dbb28cefa79ed9289fa19db7510a7078c64315f92d50ae637b7d
+  data.tar.gz: 291d1e92359fba0801ad5dfa543e6eb132c43c1f94686be5749462fcf3e18f2e
 SHA512:
-  metadata.gz: b4352492dedad2bd9881b9bc6ac5888cdf7855a798f2b650040a9a64c4f7ea81c34178a4bfadb77f5953d82498f1eea69c90529d8b3888d9d182d3896e8415ed
-  data.tar.gz: b2540b62b29a07666c66969f5d6843f674994747fe80e47e71c0ba7f03ad554ccfbd1fcfefca796b7115f6fa2643f2b57b4d058de755c499a87ac87f883a4282
+  metadata.gz: 968bac61643099b34b73696193f8b5af9ab4489393b7d3d67d4f3fe70c35509c61e48acd659d4e78f101a8fabd7be65b549e87e6376bbaa146ff6cb755b894a8
+  data.tar.gz: d901254dd56d886b96b8e4c6425958e63b97841f2682958cb1fd2b020b2799f2a81c15609f74aa8790f80692756d2647f9359f45729ac15f2ca1eaf1e20b0699

data/.standard.yml

@@ -1,6 +1,6 @@
 # For available configuration options, see:
 #   https://github.com/testdouble/standard
-ruby_version: 2.6
+ruby_version: 2.7
 
 ignore:
   - '**/*':

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
 
+## [0.8.1.beta1] - 2026-08-08
+
+- Add ML-DSA-44, ML-DSA-65, and ML-DSA-87 support following the C2SP
+  post-quantum HTTP Message Signatures profile, including raw, DER, and PEM
+  key loading and strict parameter-set binding.
+  Pull request [#29](https://github.com/nomadium/linzer/pull/29)
+  by [soatok](https://github.com/soatok).
+
+- Due to the `ml_dsa` gemspec, the minimum Ruby version was bumped to 2.7.2.
+
 ## [0.8.0] - 2026-08-08
 
 (Only one change since the last beta: the Faraday bug fix below. Everything
@@ -37,6 +47,9 @@ else shipped in earlier 0.8.0 betas.)
   - A `params_encoder` configured on the connection or request is now
     preserved, instead of being replaced with the default encoder.
 
+  Pull request [#31](https://github.com/nomadium/linzer/pull/31)
+  by [Aupajo](https://github.com/Aupajo).
+
 ## [0.8.0.beta2] - 2026-05-20
 
 - Add Web Bot Auth support, implementing the current IETF draft

data/README.md

@@ -554,6 +554,7 @@ Linzer currently supports the following signature algorithms:
 - HMAC-SHA256
 - Ed25519
 - ECDSA (P-256 and P-384 curves).
+- ML-DSA-44, ML-DSA-65, and ML-DSA-87 ([C2SP profile](https://c2sp.org/httpsig-pq))
 
 Of the JSON Web Signature (JWS) algorithms mentioned in RFC 9421,
 only Ed25519 is currently supported. Support for additional

data/lib/linzer/key/helper.rb

@@ -241,6 +241,58 @@ module Linzer
         Linzer::ECDSA::Key.new(key, id: key_id, digest: "SHA384")
       end
 
+      # Generates an ML-DSA-44 key pair.
+      #
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] A new ML-DSA-44 key pair
+      # @see https://c2sp.org/httpsig-pq C2SP post-quantum HTTP signatures
+      def generate_ml_dsa_44_key(key_id = nil)
+        generate_ml_dsa_key("ml-dsa-44", key_id)
+      end
+
+      # Generates an ML-DSA-65 key pair.
+      #
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] A new ML-DSA-65 key pair
+      def generate_ml_dsa_65_key(key_id = nil)
+        generate_ml_dsa_key("ml-dsa-65", key_id)
+      end
+
+      # Generates an ML-DSA-87 key pair.
+      #
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] A new ML-DSA-87 key pair
+      def generate_ml_dsa_87_key(key_id = nil)
+        generate_ml_dsa_key("ml-dsa-87", key_id)
+      end
+
+      # Loads a raw, DER, or PEM ML-DSA-44 private or public key.
+      #
+      # @param material [String, MlDsa::SecretKey, MlDsa::PublicKey] Key material
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] The loaded key
+      def new_ml_dsa_44_key(material, key_id = nil)
+        new_ml_dsa_key(material, "ml-dsa-44", key_id)
+      end
+
+      # Loads a raw, DER, or PEM ML-DSA-65 private or public key.
+      #
+      # @param material [String, MlDsa::SecretKey, MlDsa::PublicKey] Key material
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] The loaded key
+      def new_ml_dsa_65_key(material, key_id = nil)
+        new_ml_dsa_key(material, "ml-dsa-65", key_id)
+      end
+
+      # Loads a raw, DER, or PEM ML-DSA-87 private or public key.
+      #
+      # @param material [String, MlDsa::SecretKey, MlDsa::PublicKey] Key material
+      # @param key_id [String, nil] Optional key identifier
+      # @return [MLDSA::Key] The loaded key
+      def new_ml_dsa_87_key(material, key_id = nil)
+        new_ml_dsa_key(material, "ml-dsa-87", key_id)
+      end
+
       # Generates a new JWS key for the specified algorithm.
       #
       # This method generates keys compatible with JSON Web Signature (JWS)
@@ -269,6 +321,47 @@ module Linzer
       def jwk_import(key, params = {})
         Linzer::JWS.jwk_import(key, params)
       end
+
+      private
+
+      def generate_ml_dsa_key(algorithm, key_id)
+        parameter_set = Linzer::MLDSA::ALGORITHMS.fetch(algorithm)
+        pair = MlDsa.keygen(parameter_set)
+        Linzer::MLDSA::Key.new(pair.secret_key, id: key_id, algorithm: algorithm)
+      rescue MlDsa::Error, ArgumentError, TypeError => e
+        raise Linzer::Error, e.message, cause: e
+      end
+
+      def new_ml_dsa_key(material, algorithm, key_id)
+        parameter_set = Linzer::MLDSA::ALGORITHMS.fetch(algorithm)
+        key = deserialize_ml_dsa_key(material, parameter_set)
+        Linzer::MLDSA::Key.new(key, id: key_id, algorithm: algorithm)
+      rescue MlDsa::Error, ArgumentError, TypeError => e
+        raise Linzer::Error, e.message, cause: e
+      end
+
+      def deserialize_ml_dsa_key(material, parameter_set)
+        return material if material.is_a?(MlDsa::PublicKey) || material.is_a?(MlDsa::SecretKey)
+        unless material.is_a?(String)
+          raise TypeError, "ML-DSA key material must be a String, MlDsa::PublicKey, or MlDsa::SecretKey"
+        end
+
+        if material.bytesize == parameter_set.public_key_bytes
+          MlDsa::PublicKey.from_bytes(material, parameter_set)
+        elsif material.bytesize == parameter_set.secret_key_bytes
+          MlDsa::SecretKey.from_bytes(material, parameter_set)
+        elsif material.start_with?("-----BEGIN PUBLIC KEY-----")
+          MlDsa::PublicKey.from_pem(material)
+        elsif material.start_with?("-----BEGIN PRIVATE KEY-----")
+          MlDsa::SecretKey.from_pem(material)
+        else
+          begin
+            MlDsa::SecretKey.from_der(material)
+          rescue MlDsa::Error::Deserialization
+            MlDsa::PublicKey.from_der(material)
+          end
+        end
+      end
     end
   end
 end

data/lib/linzer/ml_dsa.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module Linzer
+  # ML-DSA support for HTTP Message Signatures as specified by https://c2sp.org/httpsig-pq
+  #
+  # @see https://c2sp.org/httpsig-pq C2SP post-quantum HTTP signatures
+  # @see https://csrc.nist.gov/pubs/fips/204/final FIPS 204
+  module MLDSA
+    ALGORITHMS = {
+      "ml-dsa-44" => MlDsa::ML_DSA_44,
+      "ml-dsa-65" => MlDsa::ML_DSA_65,
+      "ml-dsa-87" => MlDsa::ML_DSA_87
+    }.freeze
+
+    # An ML-DSA signing or verification key.
+    class Key < Linzer::Key
+      attr_reader :algorithm
+
+      def initialize(material, params = {})
+        @algorithm = String(params.fetch(:algorithm))
+        super
+      end
+
+      # Validates that the HTTP `alg` parameter matches this key's parameter set.
+      #
+      # @param parameters [Hash] HTTP signature parameters
+      # @return [true] If `alg` is absent or matches this key
+      # @raise [VerifyError] If `alg` selects another ML-DSA parameter set
+      def validate_signature_parameters(parameters)
+        supplied_algorithm = parameters["alg"] || parameters[:alg]
+        return true if supplied_algorithm.nil? || supplied_algorithm == algorithm
+
+        raise VerifyError,
+          "Signature algorithm #{supplied_algorithm} does not match key algorithm #{algorithm}"
+      end
+
+      # Signs an RFC 9421 signature base with an empty FIPS 204 context.
+      #
+      # @param data [String] Signature base bytes
+      # @return [String] Raw FIPS 204 signature bytes
+      # @raise [SigningError] If private key material is unavailable
+      def sign(data)
+        validate_signing_key
+        material.sign(data, context: "")
+      rescue MlDsa::Error => e
+        raise SigningError, e.message, cause: e
+      end
+
+      # Verifies an RFC 9421 signature base with an empty FIPS 204 context.
+      #
+      # @param signature [String] Raw FIPS 204 signature bytes
+      # @param data [String] Signature base bytes
+      # @return [Boolean] Whether the signature is valid
+      # @raise [VerifyError] If public key material is unavailable
+      def verify(signature, data)
+        validate_verify_key
+        return false unless signature.is_a?(String)
+        return false unless signature.bytesize == parameter_set.signature_bytes
+
+        verification_material.verify(data, signature, context: "")
+      rescue MlDsa::Error, ArgumentError, TypeError
+        false
+      end
+
+      private
+
+      def validate
+        super
+        expected = ALGORITHMS[algorithm]
+        raise Error, "Unsupported ML-DSA algorithm: #{algorithm}" unless expected
+
+        valid_type = material.is_a?(MlDsa::PublicKey) || material.is_a?(MlDsa::SecretKey)
+        raise Error, "Invalid ML-DSA key material" unless valid_type
+
+        return if material.param_set == expected
+
+        raise Error,
+          "ML-DSA key parameter set #{material.param_set} does not match #{algorithm}"
+      end
+
+      def parameter_set
+        ALGORITHMS.fetch(algorithm)
+      end
+
+      def verification_material
+        return material if material.is_a?(MlDsa::PublicKey)
+        return material.public_key if material.public_key
+
+        raise VerifyError, "Public key is needed!"
+      end
+
+      def compute_private?
+        material.is_a?(MlDsa::SecretKey)
+      end
+
+      def compute_public?
+        material.is_a?(MlDsa::PublicKey) ||
+          (material.is_a?(MlDsa::SecretKey) && !material.public_key.nil?)
+      end
+    end
+  end
+end

data/lib/linzer/verifier.rb

@@ -85,6 +85,10 @@ module Linzer
         raise VerifyError, "Signature raw value to cannot be null" if signature.value.nil?
         raise VerifyError, "Components cannot be null"             if signature.serialized_components.nil?
 
+        if key.respond_to?(:validate_signature_parameters)
+          key.validate_signature_parameters(signature.parameters)
+        end
+
         begin
           validate_components message, signature.serialized_components,
                              field_ids: signature.field_ids

data/lib/linzer/version.rb

@@ -3,5 +3,5 @@
 module Linzer
   # Current version of the Linzer gem.
   # @return [String]
-  VERSION = "0.8.0"
+  VERSION = "0.8.1.beta1"
 end

data/lib/linzer.rb

@@ -2,6 +2,7 @@
 
 require "starry"
 require "openssl"
+require "ml_dsa"
 require "uri"
 require "net/http"
 
@@ -26,6 +27,7 @@ require_relative "linzer/rsa_pss"
 require_relative "linzer/hmac"
 require_relative "linzer/ed25519"
 require_relative "linzer/ecdsa"
+require_relative "linzer/ml_dsa"
 require_relative "linzer/key/helper"
 require_relative "linzer/signer"
 require_relative "linzer/verifier"
@@ -33,7 +35,7 @@ require_relative "linzer/verifier"
 # Linzer is a Ruby library for HTTP Message Signatures as defined in RFC 9421.
 #
 # It provides functionality to sign and verify HTTP messages using various
-# cryptographic algorithms including RSA-PSS, HMAC-SHA256, ECDSA, and Ed25519.
+# cryptographic algorithms including RSA-PSS, HMAC-SHA256, ECDSA, Ed25519, and ML-DSA.
 #
 # @example Signing a request with Ed25519
 #   key = Linzer.generate_ed25519_key("my-key-id")

data/lib/rack/auth/signature/helpers.rb

@@ -193,7 +193,10 @@ module Rack
               "hmac-sha256"       => :new_hmac_sha256_key,
               "ecdsa-p256-sha256" => :new_ecdsa_p256_sha256_key,
               "ecdsa-p384-sha384" => :new_ecdsa_p384_sha384_key,
-              "ed25519"           => :new_ed25519_public_key
+              "ed25519"           => :new_ed25519_public_key,
+              "ml-dsa-44"         => :new_ml_dsa_44_key,
+              "ml-dsa-65"         => :new_ml_dsa_65_key,
+              "ml-dsa-87"         => :new_ml_dsa_87_key
             }
             method = key_methods[alg]
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1.beta1
 platform: ruby
 authors:
 - Miguel Landaeta
@@ -23,6 +23,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: ml_dsa
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: uri
   requirement: !ruby/object:Gem::Requirement
@@ -162,6 +176,7 @@ files:
 - lib/linzer/message/field/parser.rb
 - lib/linzer/message/overlay.rb
 - lib/linzer/message/wrapper.rb
+- lib/linzer/ml_dsa.rb
 - lib/linzer/options.rb
 - lib/linzer/rack.rb
 - lib/linzer/rsa.rb
@@ -191,7 +206,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 2.7.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="