MLDSA for Pingora

.github/workflows/ci.yml

@@ -69,7 +69,7 @@ jobs:
           key: index-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.toml') }}
           enableCrossOsArchive: true
       - name: Run clippy
-        run: cargo clippy --all --all-targets --features rpk,prf,mlkem
+        run: cargo clippy --all --all-targets --features rpk,prf,mlkem,mldsa
       - name: Check docs
         run: cargo doc --no-deps -p boring -p boring-sys -p hyper-boring -p tokio-boring --features rpk,underscore-wildcards
         env:
@@ -438,13 +438,13 @@ jobs:
       shell: bash
     - run: cargo check --no-default-features
       name: Check `--no-default-features`
-    - run: cargo check --features prf,mlkem,credential
+    - run: cargo check --features prf,mlkem,mldsa,credential
       name: Check `mlkem,credential`
     - run: cargo test --features rpk,prf
       name: Run `rpk` tests
     - run: cargo test --features underscore-wildcards
       name: Run `underscore-wildcards` tests
     - run: cargo test --features rpk,underscore-wildcards
       name: Run `rpk,underscore-wildcards` tests
-    - run: cargo test --features rpk,underscore-wildcards,mlkem
+    - run: cargo test --features rpk,underscore-wildcards,mlkem,mldsa
       name: Run `rpk,underscore-wildcards` tests

boring-sys/build/main.rs

@@ -790,6 +790,7 @@ fn generate_bindings(config: &Config) -> Result<PathBuf, Box<dyn std::error::Err
         "hrss.h",
         "md4.h",
         "md5.h",
+        "mldsa.h",
         "mlkem.h",
         "obj_mac.h",
         "objects.h",

boring-sys/src/lib.rs

@@ -68,6 +68,15 @@ pub fn init() {
     }
 }
 
+// CBS_init is inline in BoringSSL, so bindgen can't generate bindings for it.
+#[inline]
+pub fn cbs_init(data: &[u8]) -> CBS {
+    CBS {
+        data: data.as_ptr(),
+        len: data.len(),
+    }
+}
+
 pub mod internal {
     use super::EVP_MD;
     use std::os::raw::c_int;

boring/Cargo.toml

@@ -31,6 +31,8 @@ pq-experimental = []
 
 # Interface for ML-KEM (FIPS 203) post-quantum key encapsulation. Does not affect ciphers used in TLS.
 mlkem = []
+# ML-DSA (FIPS 204) post-quantum digital signature.
+mldsa = []
 
 # Expose internal `tls1_prf`
 prf = []

boring/src/lib.rs

@@ -138,6 +138,8 @@ pub mod hash;
 pub mod hmac;
 pub mod hpke;
 pub mod memcmp;
+#[cfg(feature = "mldsa")]
+pub mod mldsa;
 #[cfg(feature = "mlkem")]
 pub mod mlkem;
 pub mod nid;