You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/07/13 19:32:00 UTC
[jira] [Comment Edited] (SANTUARIO-634) Add ML-DSA and ML-KEM post-quantum cryptography support to Apache XML Security for Java
[ https://issues.apache.org/jira/browse/SANTUARIO-634?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095363#comment-18095363 ]
Freeman Yue Fang edited comment on SANTUARIO-634 at 7/13/26 7:31 PM:
---------------------------------------------------------------------
h2. Motivation
NIST finalized FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) in August 2024. These algorithms are the successors to classic asymmetric key agreement and digital signature schemes and provide security against quantum computer attacks. Integrating them into XML Security for Java enables WS-Security, XML Digital Signature, and XML Encryption stacks (including Apache WSS4J and Apache CXF) to offer PQC-protected messaging.
h2. Scope of Changes
h3. Algorithm Support Should Be Added
*ML-DSA (FIPS 204) — Digital Signatures*
|| Variant || NIST Level || URI (provisional) ||
| ML-DSA-44 | 2 | {{http://www.w3.org/tbd#ml-dsa-44}} |
| ML-DSA-65 | 3 | {{http://www.w3.org/tbd#ml-dsa-65}} |
| ML-DSA-87 | 5 | {{http://www.w3.org/tbd#ml-dsa-87}} |
*ML-KEM (FIPS 203) — Key Transport / Key Encapsulation*
|| Variant || NIST Level || URI (provisional) ||
| ML-KEM-512 | 1 | {{http://www.w3.org/tbd#ml-kem-512}} |
| ML-KEM-768 | 3 | {{http://www.w3.org/tbd#ml-kem-768}} |
| ML-KEM-1024 | 5 | {{http://www.w3.org/tbd#ml-kem-1024}} |
The URIs follow the RFC 9231 pattern and are provisional pending standardization.
And I'm going to send a PR soon.
was (Author: ffang):
h2. Motivation
NIST finalized FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) in August 2024. These algorithms are the successors to classic asymmetric key agreement and digital signature schemes and provide security against quantum computer attacks. Integrating them into XML Security for Java enables WS-Security, XML Digital Signature, and XML Encryption stacks (including Apache WSS4J and Apache CXF) to offer PQC-protected messaging.
h2. Scope of Changes
h3. Algorithm Support Should Be Added
*ML-DSA (FIPS 204) — Digital Signatures*
|| Variant || NIST Level || URI (provisional) ||
| ML-DSA-44 | 2 | {{TBD#ml-dsa-44}} |
| ML-DSA-65 | 3 | {{TBD#ml-dsa-65}} |
| ML-DSA-87 | 5 | {{TBD#ml-dsa-87}} |
*ML-KEM (FIPS 203) — Key Transport / Key Encapsulation*
|| Variant || NIST Level || URI (provisional) ||
| ML-KEM-512 | 1 | {{TBD#ml-kem-512}} |
| ML-KEM-768 | 3 | {{TBD#ml-kem-768}} |
| ML-KEM-1024 | 5 | {{TBD#ml-kem-1024}} |
The URIs follow the RFC 9231 pattern and are provisional pending standardization.
And I'm going to send a PR soon.
> Add ML-DSA and ML-KEM post-quantum cryptography support to Apache XML Security for Java
> ---------------------------------------------------------------------------------------
>
> Key: SANTUARIO-634
> URL: https://issues.apache.org/jira/browse/SANTUARIO-634
> Project: Santuario
> Issue Type: New Feature
> Components: Java
> Reporter: Freeman Yue Fang
> Assignee: Colm O hEigeartaigh
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)