Support status for Composite asymmetric schemes

[Konicai]

Hi folks, I'm here to ask if there are any current intentions or existing progress to support Composite ML-DSA signatures in circl? Also interested to hear about Composite KEMs.

I'm reaching out on behalf of Crypto4A as we would be happy to contribute an implementation for Composite ML-DSA signatures currently.

Thanks!

[Konicai]

Hi, just following up on this. I have a couple more questions surrounding the possibility of us submitting an implementation to circl:

1. Most Composite ML-DSA scheme instantiations don't have fixed key and signature sizes. Can the API of sign.Scheme be broken to accommodate this?
2. Composite ML-DSA has some instantiations where the traditional component is Brainpool. I'm not aware of an open source implementation of Brainpool that is constant time. Would a Brainpool implementation in circl be required to be constant time?

[armfazh]

Hi, it's possible to use CIRCL as a library to implement such as signatures?
also, could you please point us to a reference to the composite signature scheme.

[bwesterb]

There are two concerns.

• First, support is not very useful to us unless there is TLS integration which requires upstream support.
• Second, with the many choices of composites there is a real risk of fragmentation, see slide 29 and onwards of this presentation. If we add composites, it'd just be MLDSA44P256 for now.