THALES GROUP LIMITED DISTRIBUTION to email recipients
Hi,
Here are some small comments on the ML-DSA and ML-KEM sections.
For both ML-DSA and ML-KEM, I think the attribute footnotes are wrong for CKA_SEED. In WD08 it lists 4,5,7 but I think it should be 4,6,7.
5=must be specified with unwrap
6=must not be specified with unwrap
The seed, if provided, will be part of the unwrapped blob.
I know that we'll be discussion seeds this week, and depending on how extreme the resulting changes are this comment may no longer be relevant. But I'll make it anyway. I don't think we make it clear how CKA_SEED is handled on key-pair generation. I think we need to state not all tokens will support this, and that the key generation mechanism may contribute the CKA_SEED attribute. Or some other similar supporting text.
My next comment is related to ML-DSA (CKM_ML_DSA specifically) and the requirement to use C_VerifySignatureInit. We discussed this on Oct 8/2024. There is no requirement to use this. The tradition C_VerifyInit+C_VerifyUpdate+C_VerifyFinal APIs will work fine. The signature value is not required as it doesn't provide any input into the hash of the message.
Thanks
Darren