[Lekensteyn]

Includes upstream commits dd682072b ("Block a handful of intermediate certificates") and e52f12bcd ("crypto/x509 MTC: Update to draft -07").

ML-DSA was previously already enabled by default for TLS 1.3 servers. Now boring-pq.patch also enables ML-DSA for TLS 1.3 clients by default and in the fips202205 and fips202609 profiles.

The PQ kex patch rebase conflicted due to e52f12bcd ("crypto/x509 MTC: Update to draft -07") changing and renumbering OIDs. To reduce future conflicts, I now picked NID 959 which was previously used by CECPQ2. A trivial conflict in the SSL_CTX_use_second_keyshare addition was resolved as some definitions moved to a private openssl/ssl_deprecated.h header since 5509db769 ("ssl: Move deprecated APIs out").

Update the outdated boring crate docs, we don't support the old FIPS 140-2 validated module.

---

Notes:

• The "Limit advertising ML-DSA support to TLS 1.3" patch was sent upstream here: https://boringssl-review.googlesource.com/c/boringssl/+/104788 (the patch in this PR has been updated based on upstream feedback)
• I validated this boring version against quiche. It needs a test suite fix due to six extra bytes in the Client Hello from ML-DSA enablement: quiche: derive cwnd-related test expectations instead of hardcoding quiche#2854

[clanky-the-clanker]

💬 Approved with comments — I found no correctness or security problems in the submodule bump, the patch rebase or the docs. Only an INFO about the versioning wording and an optional suggestion remain.

Findings: 1 info · 1 suggestion

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

📖 AGENTS.md: 💬 1 suggestion

Optional contributor guidance suggestion remains open.

Recommendation: 💬 Optional Nits

• [SUGGESTION] Optional: add a short root AGENTS.md with build and test commands and notes on how the vendored BoringSSL patches are rebased.

View full review

The repository still has no root AGENTS.md or CLAUDE.md. A short file with build and test commands, and notes on how the vendored BoringSSL patches are rebased, could help with future updates like this one. Optional.

---

📋 Code Quality: 💬 1 info

No correctness problems in the rebased patch. One INFO about the versioning wording in the docs.

Recommendation: 💬 Optional Nits

• [INFO] The docs now say BoringSSL bumps ship as a minor version update instead of major. Neither the description nor the commit message explains this policy change, and this bump changes default ClientHello bytes. Please confirm it is intended. (boring/src/lib.rs:18)

View full review

• boring/src/lib.rs:18: the versioning note changed from "major version update of all crates" to "minor". This is a release-policy change, and neither the description nor the commit message mentions it. This bump also changes default ClientHello bytes, which breaks downstream tests that check exact bytes (the description notes a quiche test fix). Please confirm that "minor" is the intended policy.

boring-sys/patches/boring-pq.patch was checked and has no problems:

• NID 959 is the same across obj_dat.h, obj_mac.num and the short-name and long-name sort tables, and it does not clash with NID 958 or NID 960.
• The ML-DSA filter in tls12_add_verify_sigalgs checks hs->max_version for clients and the negotiated version for servers.
• The new default in kVerifySignatureAlgorithms matches the updated verifyDefault in the runner tests.
• The fips202205 and fips202609 sigalg changes match the isFIPSSigAlg test update.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low. TLS 1.3 clients now advertise ML-DSA by default, so the ClientHello is slightly larger. Downstream tests that check exact ClientHello bytes may need updating.

---

🔒 Security: ✅ LGTM

No security issues found.

• ML-DSA is advertised only when the maximum version (clients) or negotiated version (servers) is TLS 1.3 or higher, and tests cover TLS 1.2 clients and servers.
• The new defaults for clients and in the fips202205 and fips202609 profiles only add verification algorithms. They add no weaker algorithms and remove no checks.
• The NID renumbering is consistent across obj_dat.h, obj_mac.num and nid.h.

---

⚡ Performance: ✅ LGTM

No performance issues. Advertising ML-DSA adds about six bytes to the ClientHello. Filtering it out below TLS 1.3 is a small check once per handshake.

---

📝 Documentation: ✅ LGTM

The updated crate docs on FIPS 140-3, the prebuilt-binary environment variables and the ML-DSA defaults match the change.

---

_{Reviewed commit: 3b69e2ac}

[lukevalenta]

Looks good modulo the updates you made to the internal PR.

[Lekensteyn]

I also changed major version bump -> minor version bump since we are not going to create a v6 and break the ecosystem just because BoringSSL got a little upgrade.

[nox]

/bonk