Repository navigation
Request PQ Algorithm support #198
Description
Hello python-pkcs11 team,
I was wondering if there are any plans to add PQ algorithm support for this wrapper.
It appears IBM already has something out using ML-DSA.
- https://github.com/IBM-Cloud/hpcs-pkcs11/blob/master/samples/pkcs11-dilithium.c
- https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intro/
I am particularly curious to test with nShield HSM's as they now provide support for ML-DSA with their latest 13.7.3 release and have plans to release more algorithms in future LTS releases.
Reacted by gilweis
Activity
MatthiasValvekens commentedon Jun 29, 2025
It's difficult to do that without those algorithms making into the PKCS#11 standard. The products you linked above use proprietary extensions of the specification (they're perhaps documented publicly, but from experience trying to support vendor-specific workflows in a piece of software like this doesn't end well). From a cursory search through the most recent OASIS drafts, it looks like this'll be part of the PKCS#11 3.2 specification.
Also, testing this in CI is going to be tricky. SoftHSMv2 is not that actively maintained at this point and doesn't even implement all of the mandatory bits of PKCS#11 3.0; it'll probably be a while before it manages to ship with PQC support even after PKCS#11 3.2 lands.
abbra commentedon Dec 2, 2025
FYI, SoftHSMv2 does have a pull request to introduce ML-DSA support: softhsm/SoftHSMv2#809
Also, one can use kryoptic instead, it implements PKCS#11 3.2 API with ML-DSA and ML-KEM by embedding OpenSSL implementations. See https://github.com/latchset/kryoptic for more details.
I checked and python-pkcs11 works fine with kryoptic for classic crypto.
MatthiasValvekens commentedon Jun 23, 2026
In the time between this issue being filed and now the PKCS#11 3.2 spec was finalised, and SoftHSMv2 / opencryptoki have implemented ML-DSA and ML-KEM :).
I already merged ML-DSA support into this library. ML-KEM required a bigger change (new interface methods) but the code for that has also been written. I'm just waiting for an upstream bugfix in SoftHSMv2 to get merged before pulling those changes in (softhsm/SoftHSMv2#888).
joostd commentedon Sep 7, 2026
Is that ML-KEM code ready to be added? I noticed that this upstream bugfix has been merged.
MatthiasValvekens commentedon Sep 7, 2026
That's on me; it dropped off my radar due to other priorities. I should have a bit of slack in my schedule in the coming week or so to take another look at it and (probably) merge the change.
MatthiasValvekens commentedon Sep 7, 2026
There you go. It had already been merged, the change just needed releasing.
joostd commentedon Sep 8, 2026
Thanks! Just tested 0.10.0 and works great!