PQ key material + provider polish#5

Merged

pdb0102 merged 16 commits into

mainfrom

feature/scep-test-client-phase-4

Jun 20, 2026

Commits on Jun 20, 2026

Phase 4: implementation plan (PQ & composite + provider polish)
pdb0102
committed
Phase 4: validate IScepCrypto seam is additive-only across all 3 PQ tiers
pdb0102
committed
Phase 4: add ML-DSA/SLH-DSA/ML-KEM entries to the algorithm registry

pdb0102
and
claude
committed
Phase 4: KeySpec.Parse accepts ml-dsa/slh-dsa/ml-kem parameter sets
pdb0102
committed
Phase 4: advertise PQ algorithms and tiers (A/B yes, C no) via CryptoCapabilities

pdb0102
and
claude
committed
Phase 4: tier A — ML-DSA/SLH-DSA key generation + PKCS#8 round-trip

pdb0102
and
claude
committed
Phase 4: tier A — encode PQ CSR with PQ SubjectPublicKeyInfo and signature

pdb0102
and
claude
committed
Phase 4: tier B — catalyst alt-key via subjectAltPublicKeyInfo + --alt-key-spec

pdb0102
and
claude
committed
Phase 4: capabilities drive opinion (CuttingEdge) and PQ servers-suggest

pdb0102
and
claude
committed
Phase 4: empirical PQ probe (ML-DSA enroll -> PASSED/FINDING/FAILED)
pdb0102
committed
Phase 4: crypto info / crypto list CLI

pdb0102
and
claude
committed
Phase 4: --crypto-provider flag + config set, threaded to all crypto load sites

pdb0102
and
claude
committed
Phase 4: harden external-provider ALC loading (ambiguity check + shared-contract proof)

pdb0102
and
claude
committed
Phase 4: review polish — drop unsupported SLH-DSA f-sets from KeySpec; crypto info shows resolved provider path
pdb0102
committed
Phase 4: sync plan task statuses to completed
pdb0102
committed
Phase 4: full SLH-DSA SHA2 matrix (s+f) with correct NIST OIDs; sign PQ CSRs by OID
pdb0102
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PQ key material + provider polish#5

PQ key material + provider polish#5
pdb0102 merged 16 commits into
mainfrom
feature/scep-test-client-phase-4

Commits on Jun 20, 2026

Phase 4: implementation plan (PQ & composite + provider polish)

Phase 4: validate IScepCrypto seam is additive-only across all 3 PQ tiers

Phase 4: add ML-DSA/SLH-DSA/ML-KEM entries to the algorithm registry

Phase 4: KeySpec.Parse accepts ml-dsa/slh-dsa/ml-kem parameter sets

Phase 4: advertise PQ algorithms and tiers (A/B yes, C no) via CryptoCapabilities

Phase 4: tier A — ML-DSA/SLH-DSA key generation + PKCS#8 round-trip

Phase 4: tier A — encode PQ CSR with PQ SubjectPublicKeyInfo and signature

Phase 4: tier B — catalyst alt-key via subjectAltPublicKeyInfo + --alt-key-spec

Phase 4: capabilities drive opinion (CuttingEdge) and PQ servers-suggest

Phase 4: empirical PQ probe (ML-DSA enroll -> PASSED/FINDING/FAILED)

Phase 4: crypto info / crypto list CLI

Phase 4: --crypto-provider flag + config set, threaded to all crypto load sites

Phase 4: harden external-provider ALC loading (ambiguity check + shared-contract proof)

Phase 4: review polish — drop unsupported SLH-DSA f-sets from KeySpec; crypto info shows resolved provider path

Phase 4: sync plan task statuses to completed

Phase 4: full SLH-DSA SHA2 matrix (s+f) with correct NIST OIDs; sign PQ CSRs by OID