Recipient-aware enveloping + full post-quantum SCEP by pdb0102 · Pull Request #6 · pdb0102/SCEPwright

Recipient-aware enveloping: implementation plan

pdb0102

committed

58e081d

Recipient-aware: RecipientSelector + cert-usage classification/conformance findings

pdb0102

committed

aed0672

Recipient-aware: factor BcEnvelope.Build, branch EnvelopedData by recipient algorithm (RSA; EC/ML-KEM unsupported -> clean error)

pdb0102

committed

1804fe4

Recipient-aware: wire RecipientSelector into the enroll path (select encryption cert by KeyUsage; finding when none)

pdb0102

committed

88c3f64

Recipient-aware: fake server split signing/encryption bundle + end-to-end enroll/conformance tests

pdb0102

committed

85c17cd

Recipient-aware: implement EC key-agreement (ephemeral ECDH) enveloping + EC RA cert round-trip test

pdb0102

committed

8ceabe4

Recipient-aware: ready-to-use per-profile fake-server endpoints (/scep/<profile>) + matrix tests

pdb0102

committed

87246b7

Recipient-aware: generalize TestCa CA signer (RSA + EC/ECDSA); add ec-dual + ecdsa-rsa profiles

pdb0102

committed

fb0c9b5

Upgrade BouncyCastle 2.5.0 -> 2.6.1 (enables ML-DSA/SLH-DSA CMS signing); fix DerSequence ambiguity + DigestAlgOid deprecation

pdb0102

committed

1ad1d07

Recipient-aware: ML-DSA CA signing via SignerInfoGeneratorBuilder (BC 2.6.1); mldsa-rsa round-trip + mldsa-only finding profiles

pdb0102

committed

34bf5b4

Recipient-aware: ML-KEM KEMRecipientInfo enveloping (RFC 9629, hand-rolled CBC+GCM) + SLH-DSA CA; full PQ profile matrix round-trips

pdb0102

committed

4053050

Recipient-aware: fix KEM key-wrap to RFC 3394 AES-KeyWrap (was ECB), null-guard EncryptedContent, assert EnvelopedData version 3; verified by OpenSSL 3.6.2 interop decrypt

pdb0102

committed

feffa5d

PQ enrollment: enroll PQ subject keys over transient RSA transport (issues PQ certs); PQ outer signing (BcSelfSigned/BcPkiMessage builder path) + pure-PQ conformance probe

pdb0102

committed

519777b

Navigation Menu

Recipient-aware enveloping + full post-quantum SCEP - #6

Recipient-aware enveloping + full post-quantum SCEP#6
pdb0102 merged 13 commits into
mainfrom
feature/scep-recipient-aware

Commits on Jun 20, 2026

Recipient-aware enveloping: implementation plan

Recipient-aware: RecipientSelector + cert-usage classification/conformance findings

Recipient-aware: factor BcEnvelope.Build, branch EnvelopedData by recipient algorithm (RSA; EC/ML-KEM unsupported -> clean error)

Recipient-aware: wire RecipientSelector into the enroll path (select encryption cert by KeyUsage; finding when none)

Recipient-aware: fake server split signing/encryption bundle + end-to-end enroll/conformance tests

Recipient-aware: implement EC key-agreement (ephemeral ECDH) enveloping + EC RA cert round-trip test

Recipient-aware: ready-to-use per-profile fake-server endpoints (/scep/<profile>) + matrix tests

Recipient-aware: generalize TestCa CA signer (RSA + EC/ECDSA); add ec-dual + ecdsa-rsa profiles

Upgrade BouncyCastle 2.5.0 -> 2.6.1 (enables ML-DSA/SLH-DSA CMS signing); fix DerSequence ambiguity + DigestAlgOid deprecation

Recipient-aware: ML-DSA CA signing via SignerInfoGeneratorBuilder (BC 2.6.1); mldsa-rsa round-trip + mldsa-only finding profiles

Recipient-aware: ML-KEM KEMRecipientInfo enveloping (RFC 9629, hand-rolled CBC+GCM) + SLH-DSA CA; full PQ profile matrix round-trips

Recipient-aware: fix KEM key-wrap to RFC 3394 AES-KeyWrap (was ECB), null-guard EncryptedContent, assert EnvelopedData version 3; verified by OpenSSL 3.6.2 interop decrypt

PQ enrollment: enroll PQ subject keys over transient RSA transport (issues PQ certs); PQ outer signing (BcSelfSigned/BcPkiMessage builder path) + pure-PQ conformance probe