Skip to content

Crypto-Agility: support keys beyond RSA #349

Open

Description

@restena-sw

Our federation has signing keys for RSA, ECDSA, ML-DSA and SLH-DSA. With pyFF 3.0.0's updated dependencies on the Python cryptography library, signing documents with all four comes into reach.

The config file does not seem to have options to specify the type of key; one simply points to the key and cert files.

A first test however shows that it's failing so far, with different reasons given for ECDSA vs. PQC algorithms:

ECDSA key:

pyff.pipes:Got exception when loading/executing pipe: key error: unable to auto-detect key format from PEM data

ML-DSA and SLH-DSA keys:

pyff.pipes:Got exception when loading/executing pipe: key error: key type does not match algorithm RsaPkcs1v15(Sha256)

I can contribute towards test cases (updated scripts/genkey.sh to generate all four variants, if that is seen as helpful.

Activity

  1. vladimir-mencl-eresearch commented on Oct 29, 2026

    @vladimir-mencl-eresearch
    Contributor

    Having support for additional certificates would be very useful - I'm happy to at least help with testing.

  2. theseal commented on Nov 3, 2026

    @theseal
    Contributor

    We talked about issue yesterday and @kushaldas will give it a try to implement now when we have all dependencies in order 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions