Aditya Patwardhan 3deef6a6ef feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65 ...

Add hybrid post-quantum TLS 1.3 support, baselined on 582ff4820:
- X25519MLKEM768 hybrid key exchange (IANA group 0x11EC)
- pure ML-DSA-65 authentication via liboqs (TLS sig scheme 0x0905,
  X.509 id-ml-dsa-65, RFC 9881) — new library/mldsa65_oqs.{c,h}
- hybrid KEM glue: library/ssl_hybrid_tls.c, ssl_tls13_hybrid_kem.h
- OID / PK / TLS 1.3 wiring across ssl_tls13_*, x509_crt, pk, oid,
  tf-psa-crypto builtin drivers

ML-DSA-65 verify is guarded on MBEDTLS_SSL_TLS1_3_SIG_MLDSA65 so the tree
also builds with liboqs disabled (classical X25519+ECDSA baseline).

2026-08-11 12:01:09 +05:30

..

.gitignore

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

CMakeLists.txt

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

debug_internal.h

test_suite_debug: test the printf used by debug.c

2026-02-26 20:56:03 +01:00

debug.c

Temporarily force standard *printf functions on MingW

2026-02-26 21:34:32 +01:00

error.c

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

Makefile

Bump version

2026-03-26 22:34:28 +00:00

mbedtls_check_config.h

Merge pull request #10713 from valeriosetti/backport-pr10650

2026-04-24 14:32:42 +00:00

mbedtls_common.h

Make sure we declare TF-PSA-Crypto platform requirements before including system headers

2026-03-04 11:54:35 +01:00

mbedtls_config_check_before.h

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

mbedtls_config_check_final.h

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

mbedtls_config_check_user.h

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

mbedtls_config.c

include mbedtls_platform_requirements.h in mbedtls_config.c

2026-04-29 17:10:04 +02:00

mbedtls_platform_requirements.h

Tell MSVC to allow non-s functions where needed

2026-03-04 11:32:18 +01:00

mbedtls_utils.h

library: ssl: adjust return type of mbedtls_psa_alg_from_pk_sigalg()

2025-12-09 16:15:48 +01:00

mps_common.h

Fix some non-standard headers

2023-11-03 12:24:58 +00:00

mps_error.h

Fix some non-standard headers

2023-11-03 12:24:58 +00:00

mps_reader.c

Include ssl_misc.h for additional SSL helper files

2024-10-11 12:21:30 +01:00

mps_reader.h

Fix some non-standard headers

2023-11-03 12:24:58 +00:00

mps_trace.c

Include ssl_misc.h for additional SSL helper files

2024-10-11 12:21:30 +01:00

mps_trace.h

Include ssl_misc.h for additional SSL helper files

2024-10-11 12:21:30 +01:00

net_sockets.c

Start from a clean baseline for C11 ext1 and POSIX features

2026-03-04 11:32:18 +01:00

pkcs7.c

Merge pull request #1656 from valeriosetti/issue1598-backport4.1

2026-06-23 16:40:44 +02:00

ssl_cache.c

Update includes for each library file

2024-10-09 11:18:50 +01:00

ssl_ciphersuites_internal.h

ssl: rm useless private includes in internal headers

2025-12-01 10:24:41 +01:00

ssl_ciphersuites.c

Change the return type of mbedtls_ssl_get_ciphersuite_sig_pk_alg to mbedtls_pk_sigalg_t

2025-10-28 07:58:37 +00:00

ssl_client.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_client.h

Update includes for each library file

2024-10-09 11:18:50 +01:00

ssl_cookie.c

remove RNG parameters from SSL API's

2025-03-10 13:24:31 +00:00

ssl_debug_helpers_generated.c

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

ssl_debug_helpers.h

ssl_tls.c: Rename and expand ssl_tls13_get_hs_msg_name

2026-02-18 14:21:48 +01:00

ssl_hybrid_tls.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_misc.h

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_msg.c

dtls: Fix adaptation to first ClientHello

2026-03-25 08:45:24 +01:00

ssl_ticket.c

removed psa_crypto_init from library as this is supposed to be called by the application

2025-03-10 13:46:14 +00:00

ssl_tls12_client.c

Merge pull request #1655 from bjwtaylor/ECDHE-PSK-integer-overflow-restricted-4.1

2026-06-16 11:49:57 +02:00

ssl_tls12_server.c

restore missing ext_len set

2026-06-24 11:05:44 +01:00

ssl_tls13_client.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_tls13_generic.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_tls13_hybrid_kem.h

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_tls13_invasive.h

Update includes for each library file

2024-10-09 11:18:50 +01:00

ssl_tls13_keys.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

ssl_tls13_keys.h

Replace __attribute__((nonstring)) with macro MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING

2025-06-20 11:48:16 +01:00

ssl_tls13_server.c

tls13_fetch_handshake_msg(): Remove require_record_boundary parameter

2026-06-24 16:00:25 +02:00

ssl_tls.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

timing.c

Fix a build error with MSVC

2026-02-19 16:53:52 +01:00

version_features.c

feat(mbedtls): adds mbedtls pre built files

2026-07-09 15:37:31 +08:00

version.c

Simplify runtime version info string methods

2025-08-18 11:39:45 +02:00

x509_create.c

Fix null pointer dereference in string to names

2026-02-26 13:34:01 +00:00

x509_crl.c

Unfortunately, we had two files named oid.h - one in the main repo, and one in the tf-psa-crypto repo, and these files included the mbedtls one, so I restored the header include

2025-08-29 07:05:40 +02:00

x509_crt.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

x509_csr.c

Remove unreachable CSR extensionRequest check

2026-06-05 11:34:22 +02:00

x509_internal.h

x509: make profile checking functions internally available

2026-06-22 11:45:56 +02:00

x509_oid.c

feat(pqc): hybrid PQC TLS 1.3 — X25519MLKEM768 + ML-DSA-65

2026-08-11 12:01:09 +05:30

x509_oid.h

x509: rm useless private includes in internal headers

2025-12-01 10:24:50 +01:00

x509.c

Add improvements to code comments and docs

2026-01-12 08:19:07 +00:00

x509write_crt.c

x509: replace usage of mbedtls_pk_can_do() with mbedtls_pk_get_key_type()

2025-12-04 16:28:44 +01:00

x509write_csr.c

x509: replace usage of mbedtls_pk_can_do() with mbedtls_pk_get_key_type()

2025-12-04 16:28:44 +01:00

x509write.c

Remove two more useless internal includes

2025-12-02 12:06:39 +01:00