Support for ML-DSA keys

command/ca/health_test.go

@@ -75,13 +75,11 @@ func Test_healthAction(t *testing.T) {
 	require.NoError(t, err)
 
 	var wg sync.WaitGroup
-	wg.Add(1)
 
-	go func() {
-		defer wg.Done()
+	wg.Go(func() {
 		err = c.Run()
 		require.ErrorIs(t, err, http.ErrServerClosed)
-	}()
+	})
 
 	caCommand := cli.Command{Name: "ca"}
 	caCommand.Subcommands = []cli.Command{healthCommand()}

command/ca/init.go

@@ -223,7 +223,7 @@ func initAction(ctx *cli.Context) (err error) {
 	}
 
 	var rootCrt *x509.Certificate
-	var rootKey interface{}
+	var rootKey any
 
 	caURL := ctx.String("with-ca-url")
 	root := ctx.String("root")

command/ca/provisioner/add.go

@@ -19,6 +19,7 @@ import (
 	"github.com/smallstep/cli-utils/ui"
 	"github.com/smallstep/linkedca"
 	"go.step.sm/crypto/jose"
+	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
 
 	"github.com/smallstep/cli/flags"
@@ -687,7 +688,7 @@ func createK8SSADetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error)
 	var (
 		block   *pem.Block
 		rest    = pemKeysB
-		pemKeys = []interface{}{}
+		pemKeys = []any{}
 	)
 	for rest != nil {
 		block, rest = pem.Decode(rest)
@@ -699,7 +700,7 @@ func createK8SSADetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error)
 			return nil, errors.Wrapf(err, "error parsing public key from %s", pemKeysF)
 		}
 		switch q := key.(type) {
-		case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
+		case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey, *mldsa.PublicKey:
 		default:
 			return nil, errors.Errorf("Unexpected public key type %T in %s", q, pemKeysF)
 		}

command/ca/provisioner/update.go

@@ -19,6 +19,7 @@ import (
 
 	"github.com/smallstep/linkedca"
 	"go.step.sm/crypto/jose"
+	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
 
 	"github.com/smallstep/cli/flags"
@@ -752,7 +753,7 @@ func updateK8SSADetails(ctx *cli.Context, p *linkedca.Provisioner) error {
 		var (
 			block   *pem.Block
 			rest    = pemKeysB
-			pemKeys = []interface{}{}
+			pemKeys = []any{}
 		)
 		for rest != nil {
 			block, rest = pem.Decode(rest)
@@ -764,7 +765,7 @@ func updateK8SSADetails(ctx *cli.Context, p *linkedca.Provisioner) error {
 				return errors.Wrapf(err, "error parsing public key from %s", pemKeysF)
 			}
 			switch q := key.(type) {
-			case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
+			case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey, *mldsa.PublicKey:
 			default:
 				return errors.Errorf("Unexpected public key type %T in %s", q, pemKeysF)
 			}

command/ca/renew.go

@@ -435,9 +435,8 @@ func newRenewer(ctx *cli.Context, caURL string, cert tls.Certificate, rootFile s
 	tr := &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		TLSClientConfig: &tls.Config{
-			RootCAs:                  rootCAs,
-			PreferServerCipherSuites: true,
-			MinVersion:               tls.VersionTLS12,
+			RootCAs:    rootCAs,
+			MinVersion: tls.VersionTLS12,
 		},
 	}
 
@@ -507,7 +506,7 @@ func (r *renewer) Renew(outFile string) (resp *api.SignResponse, err error) {
 	return resp, nil
 }
 
-func (r *renewer) Rekey(priv interface{}, outCert, outKey string, writePrivateKey bool) (*api.SignResponse, error) {
+func (r *renewer) Rekey(priv any, outCert, outKey string, writePrivateKey bool) (*api.SignResponse, error) {
 	csrBytes, err := x509.CreateCertificateRequest(cryptoRand.Reader, &x509.CertificateRequest{}, priv)
 	if err != nil {
 		return nil, err
@@ -635,7 +634,7 @@ func (r *renewer) RenewWithToken(cert tls.Certificate) (*api.SignResponse, error
 		x5c = append(x5c, base64.StdEncoding.EncodeToString(b))
 	}
 	if claims.ExtraHeaders == nil {
-		claims.ExtraHeaders = make(map[string]interface{})
+		claims.ExtraHeaders = make(map[string]any)
 	}
 	claims.ExtraHeaders[jose.X5cInsecureKey] = x5c
 

command/ca/revoke.go

@@ -459,10 +459,9 @@ func (f *revokeFlow) Revoke(ctx *cli.Context, serial, token string) error {
 		tr = &http.Transport{
 			Proxy: http.ProxyFromEnvironment,
 			TLSClientConfig: &tls.Config{
-				RootCAs:                  rootCAs,
-				PreferServerCipherSuites: true,
-				Certificates:             []tls.Certificate{cert},
-				MinVersion:               tls.VersionTLS12,
+				RootCAs:      rootCAs,
+				Certificates: []tls.Certificate{cert},
+				MinVersion:   tls.VersionTLS12,
 			},
 		}
 	}

command/certificate/create.go

@@ -909,7 +909,7 @@ func parseSigner(ctx *cli.Context, defaultSigner crypto.Signer) (*x509.Certifica
 }
 
 // savePrivateKey saves the given key, asking the password if necessary.
-func savePrivateKey(ctx *cli.Context, filename string, priv interface{}, insecure bool) error {
+func savePrivateKey(ctx *cli.Context, filename string, priv any, insecure bool) error {
 	var err error
 	if insecure {
 		_, err = pemutil.Serialize(priv, pemutil.ToFile(filename, 0o600))

command/certificate/inspect.go

@@ -266,7 +266,7 @@ func inspectCertificates(ctx *cli.Context, crts []*x509.Certificate, w io.Writer
 		}
 		return nil
 	case "json":
-		var v interface{}
+		var v any
 		if len(crts) == 1 {
 			zcrt, err := zx509.ParseCertificate(crts[0].Raw)
 			if err != nil {

command/certificate/inspect_test.go

@@ -55,7 +55,7 @@ func TestInspectCertificates(t *testing.T) {
 		},
 		"format json": {"json",
 			func(buf *bytes.Buffer) {
-				var v interface{}
+				var v any
 				err := json.Unmarshal(buf.Bytes(), &v)
 				assert.NoError(t, err)
 			},
@@ -113,7 +113,7 @@ func TestInspectCertificateRequest(t *testing.T) {
 		},
 		"format json": {"json",
 			func(buf *bytes.Buffer) {
-				var v interface{}
+				var v any
 				err := json.Unmarshal(buf.Bytes(), &v)
 				assert.NoError(t, err)
 			},

command/certificate/sign.go

@@ -15,6 +15,7 @@ import (
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/ui"
 	"github.com/urfave/cli"
+	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
 	"go.step.sm/crypto/x509util"
 
@@ -295,7 +296,7 @@ func signAction(ctx *cli.Context) error {
 
 	// Read template if passed. If not use a template depending on the profile.
 	var template string
-	var userData map[string]interface{}
+	var userData map[string]any
 	if templateFile != "" {
 		b, err := utils.ReadFile(templateFile)
 		if err != nil {
@@ -423,6 +424,14 @@ func validateIssuerKey(crt *x509.Certificate, signer crypto.Signer) error {
 		if !pub.Equal(pk) {
 			return errors.New("private key does not match issuer public key")
 		}
+	case *mldsa.PublicKey:
+		pk, ok := signer.Public().(*mldsa.PublicKey)
+		if !ok {
+			return errors.New("private key type does not match issuer public key type")
+		}
+		if !pub.Equal(pk) {
+			return errors.New("private key does not match issuer public key")
+		}
 	default:
 		return errors.New("unknown public key algorithm")
 	}

command/certificate/verify.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
@@ -243,9 +244,10 @@ func verifyAction(ctx *cli.Context) error {
 		return errors.Wrapf(err, "failed to verify certificate")
 	}
 
-	verboseMSG := "certificate validated against roots\n"
+	var verboseMSG strings.Builder
+	verboseMSG.WriteString("certificate validated against roots\n")
 	if host != "" {
-		verboseMSG += "certificate host name validated\n"
+		verboseMSG.WriteString("certificate host name validated\n")
 	}
 
 	switch {
@@ -322,7 +324,7 @@ func verifyAction(ctx *cli.Context) error {
 			respReceived, err := VerifyCRLEndpoint(endpoint, cert, issuer, httpClient, insecure)
 			switch {
 			case err == nil:
-				verboseMSG += fmt.Sprintf("certificate not revoked in CRL %s\n", endpoint)
+				fmt.Fprintf(&verboseMSG, "certificate not revoked in CRL %s\n", endpoint)
 				crlVerified = true
 				break crlOut
 			case respReceived:
@@ -355,7 +357,7 @@ func verifyAction(ctx *cli.Context) error {
 			respReceived, err := VerifyOCSPEndpoint(endpoint, cert, issuer, httpClient)
 			switch {
 			case err == nil:
-				verboseMSG += fmt.Sprintf("certificate status is good according OCSP %s\n", endpoint)
+				fmt.Fprintf(&verboseMSG, "certificate status is good according OCSP %s\n", endpoint)
 				ocspVerified = true
 				break ocspOut
 			case respReceived:
@@ -372,7 +374,7 @@ func verifyAction(ctx *cli.Context) error {
 	}
 
 	if verbose {
-		fmt.Println(verboseMSG + "certficiate is valid")
+		fmt.Println(verboseMSG.String() + "certficiate is valid")
 	}
 	return nil
 }

command/crypto/jwe/decrypt.go

@@ -131,7 +131,7 @@ func decryptAction(ctx *cli.Context) error {
 		return err
 	}
 
-	var decryptKey interface{}
+	var decryptKey any
 	if isPBES2 {
 		decryptKey = pbes2Key
 	} else {

command/crypto/jws/verify.go

@@ -80,7 +80,7 @@ be encoded using Base64.`,
 }
 
 // Get the public key for a JWK.
-func publicKey(jwk *jose.JSONWebKey) interface{} {
+func publicKey(jwk *jose.JSONWebKey) any {
 	if jose.IsSymmetric(jwk) {
 		return jwk.Key
 	}

command/crypto/jwt/sign.go

@@ -215,7 +215,7 @@ the **"kid"** member of one of the JWKs in the JWK Set.`,
 
 func signAction(ctx *cli.Context) error {
 	var err error
-	var payload interface{}
+	var payload any
 
 	// Read payload if provided
 	args := ctx.Args()
@@ -404,11 +404,11 @@ func signAction(ctx *cli.Context) error {
 
 	// Add extra headers. Currently only string headers are supported.
 	for _, s := range ctx.StringSlice("header") {
-		i := strings.Index(s, "=")
-		if i == -1 {
+		before, after, ok := strings.Cut(s, "=")
+		if !ok {
 			return errs.InvalidFlagValue(ctx, "header", s, "")
 		}
-		so.WithHeader(jose.HeaderKey(s[:i]), s[i+1:])
+		so.WithHeader(jose.HeaderKey(before), after)
 	}
 
 	if isX5C {
@@ -449,7 +449,7 @@ func signAction(ctx *cli.Context) error {
 
 	// Some implementations only accept "aud" as a string.
 	// Using claim overwriting for this special case.
-	aud := make(map[string]interface{})
+	aud := make(map[string]any)
 	if len(c.Audience) == 1 {
 		aud["aud"] = c.Audience[0]
 	}
@@ -463,7 +463,7 @@ func signAction(ctx *cli.Context) error {
 	return nil
 }
 
-func readPayload(filename string) (interface{}, error) {
+func readPayload(filename string) (any, error) {
 	var r io.Reader
 	switch filename {
 	case "":
@@ -472,7 +472,7 @@ func readPayload(filename string) (interface{}, error) {
 			return nil, errors.Wrap(err, "error reading data")
 		}
 		if st.Size() == 0 && st.Mode()&os.ModeNamedPipe == 0 {
-			return make(map[string]interface{}), nil
+			return make(map[string]any), nil
 		}
 		r = os.Stdin
 	case "-":
@@ -485,7 +485,7 @@ func readPayload(filename string) (interface{}, error) {
 		r = bytes.NewReader(b)
 	}
 
-	v := make(map[string]interface{})
+	v := make(map[string]any)
 	if err := json.NewDecoder(r).Decode(&v); err != nil {
 		// Some CI platforms will feed an empty pipe as STDIN.
 		// In that case we should treat it as a valid empty JSON.

command/crypto/jwt/verify.go

@@ -108,7 +108,7 @@ type timeClaims struct {
 }
 
 // Get the public key for a JWK.
-func publicKey(jwk *jose.JSONWebKey) interface{} {
+func publicKey(jwk *jose.JSONWebKey) any {
 	if jose.IsSymmetric(jwk) {
 		return jwk.Key
 	}

command/crypto/key/fingerprint.go

@@ -174,7 +174,7 @@ func fingerprintAction(ctx *cli.Context) error {
 		return err
 	}
 
-	var key interface{}
+	var key any
 	switch {
 	case bytes.HasPrefix(b, []byte("-----BEGIN ")): // PEM format:
 		opts := []pemutil.Options{