feat(ocrypto): add pure ML-KEM-768/1024 support and unify KEM wrap paths#3562

Open

dmihalcik-virtru wants to merge 23 commits into

mainfrom

DSPX-3383-alternative-simplified

Commits on Jun 3, 2026

feat(policy,crypto): add ML-KEM 768/1024 algorithm support

dmihalcik-virtru
and
claude
committed
feat(crypto): add ML-KEM encryption and decryption

dmihalcik-virtru
and
claude
committed
feat(kas): add ml-kem support to service layer

dmihalcik-virtru
and
claude
committed
feat(kas): extend ml-kem support across service layer

dmihalcik-virtru
and
claude
committed
feat(sdk): add ml-kem algorithm support

dmihalcik-virtru
and
claude
committed
feat(otdfctl,sdk): add ml-kem support to CLI and experimental SDK

dmihalcik-virtru
and
claude
committed
feat(keygen,tests): add ml-kem key generation support

dmihalcik-virtru
and
claude
committed
test(tdf-roundtrips): add ML-KEM-768 and ML-KEM-1024 roundtrip tests

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): adopt X-Wing pattern for ML-KEM implementation

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): remove DecryptWithEphemeralKey from interface and Legacy ML-KEM types

dmihalcik-virtru
and
claude
committed
fix(security): handle StandardMLKEMCrypto in determineKeyType

dmihalcik-virtru
and
claude
committed
perf(security): pre-parse ML-KEM private key in loadKey
dmihalcik-virtru
committed
feat(kasregistry): allow ML-KEM algorithms in ListKeysRequest filter
dmihalcik-virtru
committed
fix(security): export ML-KEM public keys from InProcessProvider

dmihalcik-virtru
and
claude
committed
fix(security): allow pure ML-KEM rewrap through InProcessProvider

dmihalcik-virtru
and
claude
committed
fix(ocrypto): emit canonical PEM block types from ML-KEM encryptors

dmihalcik-virtru
and
claude
committed
test(security): cover missing-kid case in ML-KEM determineKeyType

dmihalcik-virtru
and
claude
committed
refactor(ocrypto): encode pure ML-KEM keys as SPKI/PKCS#8 with NIST OIDs

dmihalcik-virtru
and
claude
committed
feat(sdk): emit mlkem-wrapped type for pure ML-KEM KAOs

dmihalcik-virtru
and
claude
committed
feat(ocrypto): add format auto-detection for ML-KEM public keys

dmihalcik-virtru
and
claude
committed
feat(kas): add mlkem-wrapped case to rewrap handler

dmihalcik-virtru
and
claude
committed
fixup exhaustive nolint lines
dmihalcik-virtru
committed
refactor(ocrypto): unify ML-KEM, X-Wing, and NIST hybrid wrap paths

dmihalcik-virtru
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ocrypto): add pure ML-KEM-768/1024 support and unify KEM wrap paths#3562

feat(ocrypto): add pure ML-KEM-768/1024 support and unify KEM wrap paths#3562
dmihalcik-virtru wants to merge 23 commits into
mainfrom
DSPX-3383-alternative-simplified

Commits on Jun 3, 2026

feat(policy,crypto): add ML-KEM 768/1024 algorithm support

feat(crypto): add ML-KEM encryption and decryption

feat(kas): add ml-kem support to service layer

feat(kas): extend ml-kem support across service layer

feat(sdk): add ml-kem algorithm support

feat(otdfctl,sdk): add ml-kem support to CLI and experimental SDK

feat(keygen,tests): add ml-kem key generation support

test(tdf-roundtrips): add ML-KEM-768 and ML-KEM-1024 roundtrip tests

refactor(ocrypto): adopt X-Wing pattern for ML-KEM implementation

refactor(ocrypto): remove DecryptWithEphemeralKey from interface and Legacy ML-KEM types

fix(security): handle StandardMLKEMCrypto in determineKeyType

perf(security): pre-parse ML-KEM private key in loadKey

feat(kasregistry): allow ML-KEM algorithms in ListKeysRequest filter

fix(security): export ML-KEM public keys from InProcessProvider

fix(security): allow pure ML-KEM rewrap through InProcessProvider

fix(ocrypto): emit canonical PEM block types from ML-KEM encryptors

test(security): cover missing-kid case in ML-KEM determineKeyType

refactor(ocrypto): encode pure ML-KEM keys as SPKI/PKCS#8 with NIST OIDs

feat(sdk): emit mlkem-wrapped type for pure ML-KEM KAOs

feat(ocrypto): add format auto-detection for ML-KEM public keys

feat(kas): add mlkem-wrapped case to rewrap handler

fixup exhaustive nolint lines

refactor(ocrypto): unify ML-KEM, X-Wing, and NIST hybrid wrap paths