Skip to content

Allow creation of MLDSA witness keys #538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlCutter merged 1 commit into from
May 6, 2026
Merged

Allow creation of MLDSA witness keys #538

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 20 additions & 7 deletions cmd/generate_keys/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ var (
outPriv = flag.String("out_priv", "", "Output file for private key.")
outPub = flag.String("out_pub", "", "Output file for public key.")
print = flag.Bool("print", false, "Print private key, then public key, over 2 lines, to stdout.")
mldsa = flag.Bool("mldsa", false, "If set, generates an MLDSA-44 key, ed25519 otherwise.")
)

func main() {
Expand All @@ -47,14 +48,26 @@ func main() {
}
}

skey, vkey, err := note.GenerateKey(rand.Reader, *origin)
if err != nil {
klog.Exitf("Unable to create key: %q", err)
}
var (
skey, vkey string
err error
)

if *mldsa {
skey, vkey, err = f_note.GenerateMLDSAKey(*origin)
if err != nil {
klog.Exitf("Unable to create MLDSA key: %q", err)
}
} else {
skey, vkey, err = note.GenerateKey(rand.Reader, *origin)
if err != nil {
klog.Exitf("Unable to create ed25519 key: %q", err)
}

vkey, err = f_note.VKeyToCosignatureV1(vkey)
if err != nil {
klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err)
vkey, err = f_note.VKeyToCosignatureV1(vkey)
if err != nil {
klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err)
}
}

if *print {
Expand Down
33 changes: 22 additions & 11 deletions cmd/generate_keys_gcp/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ var (
origin = flag.String("origin", "", "Witness origin for the key.")
resourceSuffix = flag.String("resource_suffix", "", "Suffix to be used when naming Secret Manager resources.")
projectID = flag.String("project_id", os.Getenv("GOOGLE_CLOUD_PROJECT"), "GCP Project ID in which to store the generated secret & public keys.")
mldsa = flag.Bool("mldsa", false, "If set, generates an MLDSA-44 key, ed25519 otherwise.")
)

func main() {
Expand Down Expand Up @@ -62,30 +63,40 @@ func main() {
}
}()

var (
skey, vkey string
)

// Generate key pair
sec, pub, err := note.GenerateKey(rand.Reader, *origin)
if err != nil {
klog.Exitf("Unable to create key: %q", err)
}
if *mldsa {
skey, vkey, err = f_note.GenerateMLDSAKey(*origin)
if err != nil {
klog.Exitf("Unable to create MLDSA key: %q", err)
}
} else {
skey, vkey, err = note.GenerateKey(rand.Reader, *origin)
if err != nil {
klog.Exitf("Unable to create ed25519 key: %q", err)
}

// Convert pubk to a cosig/v1 key.
pub, err = f_note.VKeyToCosignatureV1(pub)
if err != nil {
klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err)
vkey, err = f_note.VKeyToCosignatureV1(vkey)
if err != nil {
klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err)
}
}

// Store keys in Secret Manager.
pubKName := fmt.Sprintf("witness-verifier-%s", safeResource(*resourceSuffix))
if err := createSecret(ctx, *projectID, client, pubKName, pub); err != nil {
if err := createSecret(ctx, *projectID, client, pubKName, vkey); err != nil {
exit("Failed to create secret %q: %v", pubKName, err)
}
secKName := fmt.Sprintf("witness-secret-%s", safeResource(*resourceSuffix))
if err := createSecret(ctx, *projectID, client, secKName, sec); err != nil {
if err := createSecret(ctx, *projectID, client, secKName, skey); err != nil {
exit("Failed to create secret %q: %v", secKName, err)
}

// All done!
fmt.Printf("Created new witness keypair:\n Secret name: %s\n Public name: %v\n\nPublic Key:\n%s\n", secKName, pubKName, pub)
fmt.Printf("Created new witness keypair:\n Secret name: %s\n Public name: %v\n\nPublic Key:\n%s\n", secKName, pubKName, vkey)
}

// safeResource attempts to derive a safe GCP resource name from the provided origin string.
Expand Down
3 changes: 2 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/gorilla/mux v1.8.1
github.com/mattn/go-sqlite3 v1.14.42
github.com/prometheus/client_golang v1.23.2
github.com/transparency-dev/formats v0.1.0
github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464
github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14
github.com/transparency-dev/serverless-log v0.0.0-20250425165558-64e1d2007a10
github.com/transparency-dev/tessera v1.0.3-0.20260303172654-b64a6fdf82f4
Expand All @@ -33,6 +33,7 @@ require (
cloud.google.com/go/iam v1.7.0 // indirect
cloud.google.com/go/longrunning v0.9.0 // indirect
cloud.google.com/go/monitoring v1.25.0 // indirect
filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e // indirect
github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand Down
8 changes: 6 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ cloud.google.com/go/secretmanager v1.19.0 h1:dm9BK06xl+hrxp2unT2psjZeypPj5c6uPiA
cloud.google.com/go/secretmanager v1.19.0/go.mod h1:9OmSuOeiiUicANglrbdKWSnT3gYkRcXuUQDk7dDW0zU=
cloud.google.com/go/spanner v1.90.0 h1:tVUzYI9IZJY1SDvCmCzyuLoaAyotZgiyQq6go+lNH5A=
cloud.google.com/go/spanner v1.90.0/go.mod h1:8NB5a7qgwIhGD19Ly+vkpKffPL78vIG9RcrgsuREha0=
filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e h1:VsUbObBMxXlc23Eb9VeeJYE4jvTs87qa5RqSN2U5FJU=
filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e/go.mod h1:32qQ5yj3R24Eu03iWFWchdC3OB653wPvoepWejkefbY=
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0 h1:BzsL0qE7LvtTEtXG7Dt5NS1EP0CQwI21HZfj9aGghhw=
github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0/go.mod h1:I7kE2kM3qCr9QPT4cU4cCFYkEpVyVr16YOGUHzy+nR0=
Expand Down Expand Up @@ -137,8 +139,10 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/transparency-dev/formats v0.1.0 h1:oL0zUFuYUjg8AbtjPMnIRDmjbaHo5jCjEWU5yaNuz0g=
github.com/transparency-dev/formats v0.1.0/go.mod h1:d2FibUOHfCMdCe/+/rbKt1IPLBbPTDfwj46kt541/mU=
github.com/transparency-dev/formats v0.1.1-0.20260505141615-7f7fdcf1625e h1:Narnmxre3uwnDefYUaGlLjFboH8TIFpBDXtfi6EuRRQ=
github.com/transparency-dev/formats v0.1.1-0.20260505141615-7f7fdcf1625e/go.mod h1:WUGHNGM6NfGokBnNSJ14qM4MSDmgEyoobjoM9aDgAM0=
github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464 h1:AEnMKcjHe3UvIPEB+Bm73I+Od8EfFYiCApTIgR4PBCQ=
github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464/go.mod h1:WUGHNGM6NfGokBnNSJ14qM4MSDmgEyoobjoM9aDgAM0=
github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14 h1:K8JqF1HyGDXfTdDHtHe7VsIzeuFEcfLhioOXaupKB+Q=
github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14/go.mod h1:EoKPjljyIALg1rldsJwRQVKOJO7sLd6eUqki19ruI80=
github.com/transparency-dev/serverless-log v0.0.0-20250425165558-64e1d2007a10 h1:mQ9ZzYoywyFZ4Cvm7PtbFQHm/cnKgWvUUJHQlHG608I=
Expand Down
Loading