ML-DSA

These two basic cryptography operations allow the calculation and verification of the ML-DSA signatures.

Allowed users

User

Allowed

Alternative

ExtAuth

Required access scope

Main

keymgmt:use:<KID>

where <KID> is a Key ID as a 32-character hexadecimal string

Sign

Sign a message

POST https://my.ence.do/api/crypto/pqc/mldsa/sign

Return an ML-DSA signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
ctx	String	Base64 encoded additional context data (max. 255 bytes)
kid*	String	Key ID, 32 chars hex string
msg*	String	Data message to sign (max. 2048 bytes)

Response status code

200: Operation successful

{
  "sign": "4IzdVAZlsNHaUXGNaPMUg139TwnW5QB7WvVKA...22JTTnCHuZ1Z6sc2Hvz3WETWJ0ePKUVRJ5HzxDQ==",
  "alg": "MLDSA44"  
}

400: Bad Request Incorrect argument(s)

401: Unauthorized Missing or invalid JWT_TOKEN

403: Forbidden Incorrect access scope

406: Not Acceptable Operation failed

409: Conflict Incorrect internal state

418: I'm a Teapot TLS (https) connection required

Response data for successful operation

Name	Type	Description
sign	String	Base64 encoded signature
alg	String	ML-DSA algorithm type represented by the kid

Possible alg values

Algorithm	Description
MLDSA44	Regarding FIPS 204 ML-DSA-44 key
MLDSA65	Regarding FIPS 204 ML-DSA-65 key
MLDSA87	Regarding FIPS 204 ML-DSA-87 key

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_PQC_MLDSA_SIGN	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_PQC_MLDSA_SIGN	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_PQC_MLDSA_SIGN	LOG_RESULT_OK	200

Verify

Verify the message signature

POST https://my.ence.do/api/crypto/pqc/mldsa/verify

Verify the signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
ctx	String	Base64 encoded additional context data (max. 64 bytes)
kid*	String	Key ID, 32 chars hex string
msg*	String	Data message to verify (max. 2048 bytes)
sign*	String	Signature to validate returned by sign

Response status code

200: Operation successful

400: Incorrect argument(s)

401: Missing or invalid JWT_TOKEN

403: Incorrect access scope

406: Operation failed

409: Incorrect internal state

418: TLS connection required

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_PQC_MLDSA_VERIFY	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_PQC_MLDSA_VERIFY	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_PQC_MLDSA_VERIFY	LOG_RESULT_OK	200