1#! /usr/bin/env perl
2# Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9use strict;
10use warnings;
11
12use OpenSSL::Test qw(:DEFAULT srctop_dir bldtop_dir srctop_file);
13use OpenSSL::Test::Utils;
14
15BEGIN {
16    setup("test_ml_dsa");
17}
18
19my $provconf = srctop_file("test", "fips-and-base.cnf");
20# fips will be added later
21my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
22
23use lib srctop_dir('Configurations');
24use lib bldtop_dir('.');
25
26plan skip_all => 'ML-DSA is not supported in this build' if disabled('ml-dsa');
27plan tests => 12;
28
29require_ok(srctop_file('test','recipes','tconversion.pl'));
30
31subtest "ml-dsa-44 conversions using 'openssl pkey' -- private key" => sub {
32    tconversion( -type => "pkey",
33                 -in => srctop_file("test","testmldsa44.pem"),
34                 -prefix => "mldsa44-pkey-priv" );
35};
36subtest "ml-dsa-44 conversions using 'openssl pkey' -- pkcs8 key" => sub {
37    tconversion( -type => "pkey",
38                 -in => srctop_file("test","testmldsa44.pem"),
39                 -args => ["pkey"],
40                 -prefix => "mldsa44-pkey-pkcs8" );
41};
42subtest "ml-dsa-44 conversions using 'openssl pkey' -- pub key" => sub {
43    tconversion( -type => "pkey",
44                 -in => srctop_file("test","testmldsa44pub.pem"),
45                 -args => ["pkey", "-pubin", "-pubout"],
46                 -prefix => "mldsa44-pkey-pub" );
47};
48
49subtest "ml-dsa-65 conversions using 'openssl pkey' -- private key" => sub {
50    tconversion( -type => "pkey",
51                 -in => srctop_file("test","testmldsa65.pem"),
52                 -prefix => "mldsa65-pkey-priv");
53};
54subtest "ml-dsa-65 conversions using 'openssl pkey' -- pkcs8 key" => sub {
55    tconversion( -type => "pkey", -in => srctop_file("test","testmldsa65.pem"),
56                 -args => ["pkey"], -prefix => "mldsa65-pkey-pkcs8");
57};
58subtest "ml-dsa-65 conversions using 'openssl pkey' -- pub key" => sub {
59    tconversion( -type => "pkey",
60                 -in => srctop_file("test","testmldsa65pub.pem"),
61                 -args => ["pkey", "-pubin", "-pubout"],
62                 -prefix => "mldsa65-pkey-pub" );
63};
64
65subtest "ml-dsa-87 conversions using 'openssl pkey' -- private key" => sub {
66    tconversion( -type => "pkey",
67                 -in => srctop_file("test","testmldsa87.pem"),
68                 -prefix => "mldsa87-pkey-priv" );
69};
70subtest "ml-dsa-87 conversions using 'openssl pkey' -- pkcs8 key" => sub {
71    tconversion( -type => "pkey",
72                 -in => srctop_file("test","testmldsa87.pem"),
73                 -args => ["pkey"],
74                 -prefix => "mldsa87-pkey-pkcs8" );
75};
76subtest "ml-dsa-87 conversions using 'openssl pkey' -- pub key" => sub {
77    tconversion( -type => "pkey",
78                 -in => srctop_file("test","testmldsa87pub.pem"),
79                 -args => ["pkey", "-pubin", "-pubout"],
80                 -prefix => "mldsa87-pkey-pub" );
81};
82
83ok(run(test(["ml_dsa_test"])), "running ml_dsa_test");
84
85SKIP: {
86    skip "Skipping FIPS tests", 1
87        if $no_fips;
88
89    # ML-DSA is only present after OpenSSL 3.5
90    run(test(["fips_version_test", "-config", $provconf, ">=3.5.0"]),
91             capture => 1, statusvar => \my $exit);
92    skip "FIPS provider version is too old for ML-DSA test", 1
93        if !$exit;
94
95    ok(run(test(["ml_dsa_test", "-config",  $provconf])),
96           "running ml_dsa_test with FIPS");
97}
98