[davidben]

Part of #184. I haven't done ML-KEM yet, but it should be fairly easy to extend the script.

Also fix a typo in mldsa_verify_schema.json. This went unnoticed because both missing and extra fields are allowed.

Generated with this script:

import json
import sys

OIDS = {
    "ML-DSA-44": b"\x60\x86\x48\x01\x65\x03\x04\x03\x11",
    "ML-DSA-65": b"\x60\x86\x48\x01\x65\x03\x04\x03\x12",
    "ML-DSA-87": b"\x60\x86\x48\x01\x65\x03\x04\x03\x13",
}

SEQUENCE = 0x30
INTEGER = 0x02
BIT_STRING = 0x03
OCTET_STRING = 0x04
OBJECT_IDENTIFIER = 0x06

CONTEXT_SPECIFIC = 0x80
CONSTRUCTED = 0x20

def encode_der(tag, body):
    ret = bytearray()
    ret.append(tag)
    if len(body) < 0x80:
        ret.append(len(body))
    elif len(body) <= 0xff:
        ret.append(0x81)
        ret.append(len(body))
    elif len(body) <= 0xffff:
        ret.append(0x82)
        ret.append(len(body) >> 8)
        ret.append(len(body) & 0xff)
    ret.extend(body)
    return bytes(ret)

def insert_after(d, pos, new_key, new_value):
    # This is silly. Maybe we can automatically order fields by the schema?
    # Or just alphabetize...
    if new_key in d:
        d[new_key] = new_value
        return
    assert pos in d
    items = list(d.items())
    d.clear()
    for k, v in items:
        d[k] = v
        if k == pos:
            d[new_key] = new_value

def algorithm_identifier_no_params(oid):
    return encode_der(
        SEQUENCE,
        encode_der(OBJECT_IDENTIFIER, oid)
    )

def fix_mldsa_verify(alg, g):
    key = bytes.fromhex(g["publicKey"])
    # This would just be adding a fixed prefix, except that some inputs
    # intentionally have the wrong length.
    spki = encode_der(
        SEQUENCE,
        algorithm_identifier_no_params(OIDS[alg]) +
        encode_der(
            BIT_STRING,
            b"\x00" + key,
        )
    )
    insert_after(g, "publicKey", "publicKeyDer", spki.hex())

def fix_mldsa_sign(alg, g):
    seed = bytes.fromhex(g["privateSeed"])
    pkcs8 = encode_der(
        SEQUENCE,
        encode_der(INTEGER, b"\x00") +
        algorithm_identifier_no_params(OIDS[alg]) +
        encode_der(
            OCTET_STRING,
            encode_der(CONTEXT_SPECIFIC | 0, seed)
        )
    )
    insert_after(g, "privateSeed", "privateKeyPkcs8", pkcs8.hex())

def fix(path):
    with open(path) as f:
        j = json.load(f)
    for g in j["testGroups"]:
        if j["schema"] == "mldsa_verify_schema.json" and g["type"] == "MlDsaVerify":
            fix_mldsa_verify(j["algorithm"], g)
        elif j["schema"] == "mldsa_sign_seed_schema.json" and g["type"] == "MlDsaSign":
            fix_mldsa_sign(j["algorithm"], g)
    with open(path, "w") as f:
        json.dump(j, f, indent=2, separators=(",", ": "), ensure_ascii=False)
        f.write("\n")

for arg in sys.argv[1:]:
    fix(arg)

[botovq]

LGTM. I checked your python script and verified the output with that. I also manually spot-checked the DER prefixes using der2ascii.

[botovq]

The schema changes also read fine.