feat: add ML-DSA-65 and ML-DSA-87 support to JWT encode and decode - #18132
feat: add ML-DSA-65 and ML-DSA-87 support to JWT encode and decode#18132ohmayr wants to merge 3 commits into
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Code Review
This pull request adds support for Post-Quantum Cryptography (PQC) algorithms, specifically ML-DSA-65 and ML-DSA-87, for JWT encoding and decoding. It integrates the pqc module from google.auth.crypt and updates algorithm mapping and header generation. Feedback on the changes suggests skipping the new unit tests if the pqc module is unavailable and correcting the reference to PqcSigner to use crypt.pqc.PqcSigner instead of crypt.PqcSigner.
Sorry, something went wrong.
| assert header == {"typ": "JWT", "alg": "ES384", "kid": es384_signer.key_id} | ||
|
|
||
|
|
||
| def test_encode_basic_mldsa(monkeypatch): |
There was a problem hiding this comment.
The test_encode_basic_mldsa test should be skipped if the pqc module is not available. Use pytest.skip() to skip the entire test.
def test_encode_basic_mldsa(monkeypatch):
if jwt.pqc is None:
pytest.skip("pqc is not available")- Use pytest.skip() to skip an entire test.
Sorry, something went wrong.
|
|
||
| b64_key = base64.b64encode(der_bytes).decode("ascii") | ||
| pem = f"-----BEGIN PRIVATE KEY-----\n{b64_key}\n-----END PRIVATE KEY-----" | ||
| mldsa_signer = crypt.PqcSigner.from_string(pem, "key-mldsa-65") |
There was a problem hiding this comment.
Use crypt.pqc.PqcSigner instead of crypt.PqcSigner because PqcSigner is defined in the pqc submodule and is not directly exposed on the parent crypt module.
| mldsa_signer = crypt.PqcSigner.from_string(pem, "key-mldsa-65") | |
| mldsa_signer = crypt.pqc.PqcSigner.from_string(pem, "key-mldsa-65") |
Sorry, something went wrong.
| assert payload["metadata"]["meta"] == "data" | ||
|
|
||
|
|
||
| def test_decode_valid_mldsa(monkeypatch): |
There was a problem hiding this comment.
The test_decode_valid_mldsa test should be skipped if the pqc module is not available. Use pytest.skip() to skip the entire test.
def test_decode_valid_mldsa(monkeypatch):
if jwt.pqc is None:
pytest.skip("pqc is not available")- Use pytest.skip() to skip an entire test.
Sorry, something went wrong.
|
|
||
| b64_key = base64.b64encode(der_bytes).decode("ascii") | ||
| pem = f"-----BEGIN PRIVATE KEY-----\n{b64_key}\n-----END PRIVATE KEY-----" | ||
| mldsa_signer = crypt.PqcSigner.from_string(pem, "key-mldsa-65") |
There was a problem hiding this comment.
Use crypt.pqc.PqcSigner instead of crypt.PqcSigner because PqcSigner is defined in the pqc submodule and is not directly exposed on the parent crypt module.
| mldsa_signer = crypt.PqcSigner.from_string(pem, "key-mldsa-65") | |
| mldsa_signer = crypt.pqc.PqcSigner.from_string(pem, "key-mldsa-65") |
Sorry, something went wrong.
Reviewers
1 more reviewerAt least 1 approving review is required to merge this pull request.
WIP