Add support for ML-DSA

.github/workflows/unit-test.yml

@@ -7,24 +7,29 @@ on:
   pull_request:
     branches: [ main ]
 
+# Deny all default permissions globally
+permissions: {}
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813  # v1.4.3
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
       with:
         # Using audit because some endpoints are not reliably fixed. We could
         # try to nail them down, but it would turn into a game of whack-a-mole.
         egress-policy: audit
         disable-telemetry: true
-    - uses: actions/checkout@v4 # v3
-    - name: set up JDK 11
-      uses: actions/setup-java@v4  # v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - name: set up JDK 21
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
       with:
-        java-version: '11'
+        java-version: '21'
         distribution: 'temurin'
         cache: maven
     - name: Build

pom.xml

@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.google.cose</groupId>
   <artifactId>cose</artifactId>
-  <version>20230908</version>
+  <version>20260917</version>
   <dependencies>
     <dependency>
       <groupId>co.nstant.in</groupId>
@@ -34,6 +34,17 @@
       <artifactId>bcprov-jdk18on</artifactId>
       <version>1.84</version>
     </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.4.5</version>
+      <scope>test</scope>
+    </dependency>
+<dependency>
+    <groupId>org.conscrypt</groupId>
+    <artifactId>conscrypt-openjdk-uber</artifactId>
+    <version>2.6.0</version>
+</dependency>
   </dependencies>
   <packaging>jar</packaging>
   <name>COSE for Java</name>
@@ -99,10 +110,10 @@
             <configuration>
               <rules>
                 <requireMavenVersion>
-                  <version>3.0.5</version>
+                  <version>3.6.3</version>
                 </requireMavenVersion>
                 <requireJavaVersion>
-                  <version>1.8.0</version>
+                  <version>21.0.0</version>
                 </requireJavaVersion>
               </rules>
             </configuration>
@@ -117,14 +128,8 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
         <configuration>
-          <!--
-            Target Java 8 so that we are roughly compatible with Android API level
-            26/Android 8. If we targeted a newer version, the identity credentials
-            code wouldn't be able to take a dependency on this library.
-          -->
-          <source>8</source>
-          <target>8</target>
-	  <fork>true</fork>
+          <release>21</release>
+          <fork>true</fork>
           <compilerArgs>
             <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
             <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg>
@@ -158,9 +163,22 @@
           <configuration>
             <source>1.8</source>
             <target>1.8</target>
+            <fork>true</fork>
             <compilerArgs>
               <arg>-XDcompilePolicy=simple</arg>
               <arg>-Xplugin:ErrorProne</arg>
+              <arg>--should-stop=ifError=FLOW</arg>
+              <arg>-Xlint:-options</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED</arg>
+              <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED</arg>
+              <arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg>
+              <arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED</arg>
             </compilerArgs>
             <annotationProcessorPaths>
               <path>
@@ -227,11 +245,14 @@
               <include>${test.include}</include>
             </includes>
             <redirectTestOutputToFile>false</redirectTestOutputToFile>
-            <forkCount>0</forkCount>
+            <forkCount>1</forkCount>
+            <systemPropertyVariables>
+              <org.conscrypt.native.workdir>${project.build.directory}</org.conscrypt.native.workdir>
+            </systemPropertyVariables>
             <runOrder>alphabetical</runOrder>
             <!-- Set max heap for tests. -->
             <!-- Catch dependencies on the default locale by setting it to hi-IN. -->
-            <argLine>-Xmx1536M -Duser.language=hi -Duser.country=IN ${test.add.opens}</argLine>
+            <argLine>-Xmx1536M --enable-native-access=ALL-UNNAMED -Duser.language=hi -Duser.country=IN ${test.add.opens}</argLine>
           </configuration>
         </plugin>
         <plugin>

src/com/google/cose/AkpKey.java

@@ -0,0 +1,152 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.cose;
+
+import co.nstant.in.cbor.CborException;
+import co.nstant.in.cbor.model.ByteString;
+import co.nstant.in.cbor.model.DataItem;
+import co.nstant.in.cbor.model.Map;
+import co.nstant.in.cbor.model.NegativeInteger;
+import com.google.cose.exceptions.CoseException;
+import com.google.cose.utils.Algorithm;
+import com.google.cose.utils.CborUtils;
+import com.google.cose.utils.CoseUtils;
+import com.google.cose.utils.Headers;
+import com.google.errorprone.annotations.CanIgnoreReturnValue;
+import java.util.Arrays;
+import java.util.Objects;
+
+/** Abstract class for generic AKP key */
+public abstract class AkpKey extends CoseKey {
+
+  public static final String PROVIDER = "Conscrypt";
+
+  protected byte[] publicKeyBytes;
+  protected byte[] privateKeyBytes;
+
+  AkpKey(DataItem cborKey) throws CborException, CoseException {
+    super(cborKey);
+    populateKeyFromCbor();
+  }
+
+  void populateKeyFromCbor() throws CborException, CoseException {
+    if (getKeyType() != Headers.KEY_TYPE_AKP) {
+      throw new CoseException("Expecting KEY_TYPE_AKP (type 7), found type " + getKeyType());
+    }
+
+    if (getAlgorithm() == null) {
+      throw new CoseException("Algorithm is required for AKP keys.");
+    }
+
+    Algorithm algorithm = Algorithm.fromCoseAlgorithmId(getAlgorithm());
+
+    if (!isAkpAlgorithm(algorithm)) {
+      throw new CoseException(
+          "Expecting an AKP signing algorithm, found " + algorithm.getJavaAlgorithmId());
+    }
+
+    if (labels.containsKey(Headers.KEY_PARAMETER_AKP_PUB)) {
+      publicKeyBytes = CborUtils.asByteString(labels.get(Headers.KEY_PARAMETER_AKP_PUB)).getBytes();
+    }
+    if (labels.containsKey(Headers.KEY_PARAMETER_AKP_PRIV)) {
+      privateKeyBytes =
+          CborUtils.asByteString(labels.get(Headers.KEY_PARAMETER_AKP_PRIV)).getBytes();
+    }
+
+    if (publicKeyBytes == null && privateKeyBytes == null) {
+      throw new CoseException(CoseException.MISSING_KEY_MATERIAL_EXCEPTION_MESSAGE);
+    }
+  }
+
+  void verifyAlgorithmAllowedByKey(Algorithm algorithm) throws CborException, CoseException {
+    Map keyMap = CborUtils.asMap(encode());
+    DataItem algo = CoseUtils.getValueFromMap(keyMap, Headers.KEY_PARAMETER_ALGORITHM);
+    if (algo == null) {
+      throw new CoseException("Algorithm is required for AKP keys.");
+    }
+    if (!algo.equals(algorithm.getCoseAlgorithmId())) {
+      throw new CoseException("Algorithm not compatible with AKP key.");
+    }
+  }
+
+  public byte[] getPublicKeyBytes() {
+    return Arrays.copyOf(publicKeyBytes, publicKeyBytes.length);
+  }
+
+  /** Recursive builder to build out the AKP key and its subclasses. */
+  abstract static class Builder<T extends Builder<T>> extends CoseKey.Builder<T> {
+    protected byte[] publicKey;
+    protected byte[] privateKey;
+
+    @Override
+    void verifyKeyMaterialPresentAndComplete() throws CoseException {
+      if (!isKeyMaterialPresent()) {
+        throw new CoseException(CoseException.MISSING_KEY_MATERIAL_EXCEPTION_MESSAGE);
+      }
+      if (algorithm == null) {
+        throw new CoseException("Algorithm is required for AKP keys.");
+      }
+
+      if (!isAkpAlgorithm(algorithm)) {
+        throw new CoseException(
+            "Expecting an AKP signing algorithm, found " + algorithm.getJavaAlgorithmId());
+      }
+    }
+
+    boolean isKeyMaterialPresent() {
+      return publicKey != null || privateKey != null;
+    }
+
+    @Override
+    protected Map compile() throws CoseException {
+      withKeyType(Headers.KEY_TYPE_AKP);
+
+      Map cborKey = super.compile();
+
+      if (publicKey != null) {
+        cborKey.put(new NegativeInteger(Headers.KEY_PARAMETER_AKP_PUB), new ByteString(publicKey));
+      }
+      if (privateKey != null) {
+        cborKey.put(
+            new NegativeInteger(Headers.KEY_PARAMETER_AKP_PRIV), new ByteString(privateKey));
+      }
+      return cborKey;
+    }
+
+    @CanIgnoreReturnValue
+    public T withPublicKey(byte[] publicKey) {
+      this.publicKey = Arrays.copyOf(publicKey, publicKey.length);
+      return self();
+    }
+
+    @CanIgnoreReturnValue
+    public T withPrivateKey(byte[] privateKey) {
+      this.privateKey = Arrays.copyOf(privateKey, privateKey.length);
+      return self();
+    }
+  }
+
+  public static boolean isAkpAlgorithm(Algorithm algorithm) {
+    return algorithm == Algorithm.SIGNING_ALGORITHM_MLDSA_44
+        || algorithm == Algorithm.SIGNING_ALGORITHM_MLDSA_65
+        || algorithm == Algorithm.SIGNING_ALGORITHM_MLDSA_87;
+  }
+
+  public static boolean isConscryptProvider(String provider) {
+    return Objects.equals(provider, PROVIDER);
+  }
+}