Crypto-Agility: support keys beyond RSA

Our federation has signing keys for RSA, ECDSA, ML-DSA and SLH-DSA. With pyFF 3.0.0's updated dependencies on the Python cryptography library, signing documents with all four comes into reach.

The config file does not seem to have options to specify the type of key; one simply points to the key and cert files.

A first test however shows that it's failing so far, with different reasons given for ECDSA vs. PQC algorithms:

ECDSA key:

pyff.pipes:Got exception when loading/executing pipe: key error: unable to auto-detect key format from PEM data

ML-DSA and SLH-DSA keys:

pyff.pipes:Got exception when loading/executing pipe: key error: key type does not match algorithm RsaPkcs1v15(Sha256)

I can contribute towards test cases (updated scripts/genkey.sh to generate all four variants, if that is seen as helpful.

Having support for additional certificates would be very useful - I'm happy to at least help with testing.

@kushaldas

We talked about issue yesterday and @kushaldas will give it a try to implement now when we have all dependencies in order 👍

@restena-sw

@restena-sw can you try the branch in #352?

Hm I usually install with "pip install" and could do install of a specific branch. But not sure how to reference a pending pull request.

Unless you can spoon-feed me with the pip instructions to check out the PR specifically, I'd be happy enough to test the feat branch post-merge.

pyFF comes with a uv.lock file, so assuming you have uv installed, you can install the deps with uv sync --locked in the checked out directory (and correct branch) into .venv/bin/pyff.

If you do not have uv - you either download directly as per uv instructions, or install it into a python venv.

Full run-sheet:

sudo apt install python3-venv
python3 -m venv uv-env
~/uv-env/bin/pip install uv
git clone https://github.com/SUNET/pyFF
cd pyFF
git checkout feat/keys
~/uv-env/bin/uv sync --locked
.venv/bin/pyff --version

Tried this, report see #352 . The most interesting bits (PQC) work just fine, only having some issue with ECDSA.

Navigation Menu

Repository navigation

Crypto-Agility: support keys beyond RSA #349

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Crypto-Agility: support keys beyond RSA #349

Description

Activity

vladimir-mencl-eresearch commented on Oct 29, 2026

theseal commented on Nov 3, 2026

theseal commented on Nov 10, 2026

restena-sw commented on Nov 10, 2026

vladimir-mencl-eresearch commented on Nov 10, 2026

restena-sw commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions