4. Subject Public Key Fields

Dieser Abschnitt bewahrt den RFC-Text fuer ML-KEM in PKIX, einschliesslich algorithm identifiers, SubjectPublicKeyInfo, private key formats, ASN.1 objects, security considerations und examples.

4.  Subject Public Key Fields

   In the X.509 certificate, the subjectPublicKeyInfo field has the
   SubjectPublicKeyInfo type, which has the following ASN.1 syntax:

     SubjectPublicKeyInfo {PUBLIC-KEY: IOSet} ::= SEQUENCE {
         algorithm        AlgorithmIdentifier {PUBLIC-KEY, {IOSet}},
         subjectPublicKey BIT STRING
     }

   The fields in SubjectPublicKeyInfo have the following meaning:

   *  algorithm is the algorithm identifier and parameters for the
      public key (see above).

   *  subjectPublicKey contains the byte stream of the public key.

   For each ML-KEM parameter set (see Table 1), we define a PUBLIC-KEY
   ASN.1 type as follows:

     pk-ml-kem-512 PUBLIC-KEY ::= {
       IDENTIFIER id-alg-ml-kem-512
       -- KEY no ASN.1 wrapping; 800 octets --
       PARAMS ARE absent
       CERT-KEY-USAGE { keyEncipherment }
       PRIVATE-KEY ML-KEM-512-PrivateKey -- defined in Section 6
       }

     pk-ml-kem-768 PUBLIC-KEY ::= {
       IDENTIFIER id-alg-ml-kem-768
       -- KEY no ASN.1 wrapping; 1184 octets --
       PARAMS ARE absent
       CERT-KEY-USAGE { keyEncipherment }
       PRIVATE-KEY ML-KEM-768-PrivateKey -- defined in Section 6
       }

     pk-ml-kem-1024 PUBLIC-KEY ::= {
       IDENTIFIER id-alg-ml-kem-1024
       -- KEY no ASN.1 wrapping; 1568 octets --
       PARAMS ARE absent
       CERT-KEY-USAGE { keyEncipherment }
       PRIVATE-KEY ML-KEM-1024-PrivateKey -- defined in Section 6
       }

     ML-KEM-512-PublicKey ::= OCTET STRING (SIZE (800))

     ML-KEM-768-PublicKey ::= OCTET STRING (SIZE (1184))

     ML-KEM-1024-PublicKey ::= OCTET STRING (SIZE (1568))

   When an ML-KEM public key appears outside of a SubjectPublicKeyInfo
   type in an environment that uses ASN.1 encoding, it can be encoded as
   an OCTET STRING by using the ML-KEM-512-PublicKey, ML-KEM-
   768-PublicKey, and ML-KEM-1024-PublicKey types corresponding to the
   correct key size.

   [RFC5958] describes the Asymmetric Key Package's OneAsymmetricKey
   type for encoding asymmetric key pairs.  When an ML-KEM private key
   or key pair is encoded as a OneAsymmetricKey, it follows the
   description in Section 6.

   When the ML-KEM private key appears outside of an Asymmetric Key
   Package in an environment that uses ASN.1 encoding, it can be encoded
   using one of the ML-KEM-PrivateKey CHOICE formats defined in
   Section 6.  The seed format is RECOMMENDED, as it efficiently stores
   both the private and public key.

   Appendix C.2 contains examples for ML-KEM public keys encoded using
   the textual encoding defined in [RFC7468].