Summary

Update the ML-KEM private key encoding to align with Section 6 of draft-ietf-lamps-kyber-certificates-10. Specifically, the privateKey field in OneAsymmetricKey will follow the DER-encoded CHOICE structure as defined: it must contain one of the three permitted alternatives described in the draft.

Problem

When ML-KEM was initially implemented in OpenJDK, earlier versions of draft-ietf-lamps-kyber-certificates described the private key simply as “an opaque byte sequence,” without specifying a concrete format. Based on that, we adopted the encoding defined in NIST FIPS 203 — specifically, the private key output from the ML-KEM.KeyGen function (Section 7.1 of FIPS 203).

In the final revision of the draft, the private key format has been formally defined as a DER-encoded ASN.1 CHOICE. For ML-KEM-512, for example:

ML-KEM-512-PrivateKey ::= CHOICE {
    seed [0] OCTET STRING (SIZE (64)),
    expandedKey OCTET STRING (SIZE (1632)),
    both SEQUENCE {
        seed OCTET STRING (SIZE (64)),
        expandedKey OCTET STRING (SIZE (1632))
    }
}

Similar structures are defined for ML-KEM-768 and ML-KEM-1024.

Our current implementation corresponds to the second choice, expandedKey OCTET STRING. To comply with the updated specification, we must update our implementation to support the other two choices as well.

Solution

Update the ML-KEM private key encoding to support the new CHOICE structure. A new security or system property will control which of the three CHOICE options is used by the JDK.

When KeyPairGenerator::generateKey or KeyFactory::translateKey is invoked, the returned ML-KEM private key will be encoded using the selected format.

Note: If KeyFactory::translateKey is used to convert a key that lacks a seed into a format that includes the seed, the operation will fail and an InvalidKeyException will be thrown.

Specification

A new security property, jdk.mlkem.pkcs8.encoding, is introduced to control the encoding format of ML-KEM private keys in PKCS #8.

The following entry is added to the java.security file:

#
# The privateKey field for newly created ML-KEM private keys in PKCS #8
#
# The draft-ietf-lamps-kyber-certificates specification defines three formats
# for an ML-KEM private key: a 64-byte seed, an expanded private key,
# or a sequence containing both.
#
# Valid values for this property are "seed", "expandedKey", and "both"
# (case-insensitive). The default is "seed".
#
# This property determines the encoding format used when a new keypair is
# generated using a KeyPairGenerator, as well as the output of the translateKey
# method on an existing key using a KeyFactory.
#
# If a system property of the same name is also specified, it supersedes the
# security property value defined here.
#
# Note: This property is currently used by the SunJCE provider in the JDK
# Reference implementation. It is not guaranteed to be supported by other
# SE implementations.
#
#jdk.mlkem.pkcs8.encoding = seed