Fix use of SHAKE as a digest in CMS

danvangeest · t8m · commit c1d27789e995 · 2025-03-20T12:20:37.000+01:00
draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as the message digest algorithm for SLH-DSA-SHAKE-* in CMS. SHAKE doesn't have a default digest length, so this adds a SHAKE-specific kludge in CMS. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from openssl#27087)
diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c
@@ -14,6 +14,7 @@
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 #include <openssl/cms.h>
+#include <openssl/core_names.h>
 #include "internal/sizes.h"
 #include "internal/cryptlib.h"
 #include "crypto/x509.h"
@@ -407,6 +408,7 @@ BIO *ossl_cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm,
     const EVP_MD *digest = NULL;
     EVP_MD *fetched_digest = NULL;
     char alg[OSSL_MAX_NAME_SIZE];
+    size_t xof_len = 0;
 
     X509_ALGOR_get0(&digestoid, NULL, NULL, digestAlgorithm);
     OBJ_obj2txt(alg, sizeof(alg), digestoid, 0);
@@ -431,6 +433,24 @@ BIO *ossl_cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm,
         ERR_raise(ERR_LIB_CMS, CMS_R_MD_BIO_INIT_ERROR);
         goto err;
     }
+    if (EVP_MD_xof(digest)) {
+        if (EVP_MD_is_a(digest, SN_shake128))
+            xof_len = 32;
+        else if (EVP_MD_is_a(digest, SN_shake256))
+            xof_len = 64;
+        if (xof_len > 0) {
+            EVP_MD_CTX *mdctx;
+            OSSL_PARAM params[2];
+
+            if (BIO_get_md_ctx(mdbio, &mdctx) <= 0 || mdctx == NULL)
+                goto err;
+            params[0] = OSSL_PARAM_construct_size_t(OSSL_DIGEST_PARAM_XOFLEN,
+                                                    &xof_len);
+            params[1] = OSSL_PARAM_construct_end();
+            if (!EVP_MD_CTX_set_params(mdctx, params))
+                goto err;
+        }
+    }
     EVP_MD_free(fetched_digest);
     return mdbio;
  err:
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
@@ -52,7 +52,7 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
 
 $no_rc2 = 1 if disabled("legacy");
 
-plan tests => 28;
+plan tests => 30;
 
 ok(run(test(["pkcs7_test"])), "test pkcs7");
 
@@ -1398,3 +1398,65 @@ subtest "EdDSA tests for CMS \n" => sub {
            "accept CMS verify with Ed25519");
     }
 };
+
+subtest "ML-DSA tests for CMS \n" => sub {
+    plan tests => 2;
+
+    SKIP: {
+        skip "ML-DSA is not supported in this build", 2
+            if disabled("ml-dsa");
+
+        my $sig1 = "sig1.cms";
+
+        # draft-ietf-lamps-cms-ml-dsa: use SHA512 with ML-DSA
+        ok(run(app(["openssl", "cms", @prov, "-sign", "-md", "sha512", "-in", $smcont,
+                    "-certfile", $smroot, "-signer", catfile($smdir, "sm_mldsa44.pem"),
+                    "-out", $sig1])),
+           "accept CMS signature with ML-DSA-44");
+
+        ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig1,
+                    "-CAfile", $smroot, "-content", $smcont])),
+           "accept CMS verify with ML-DSA-44");
+    }
+};
+
+subtest "SLH-DSA tests for CMS \n" => sub {
+    plan tests => 6;
+
+    SKIP: {
+        skip "SLH-DSA is not supported in this build", 6
+            if disabled("slh-dsa");
+
+        my $sig1 = "sig1.cms";
+
+        # draft-ietf-lamps-cms-sphincs-plus: use SHA512 with SLH-DSA-SHA2
+        ok(run(app(["openssl", "cms", @prov, "-sign", "-md", "sha512", "-in", $smcont,
+                    "-certfile", $smroot, "-signer", catfile($smdir, "sm_slhdsa_sha2_128s.pem"),
+                    "-out", $sig1])),
+           "accept CMS signature with SLH-DSA-SHA2-128s");
+
+        ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig1,
+                    "-CAfile", $smroot, "-content", $smcont])),
+           "accept CMS verify with SLH-DSA-SHA2-128s");
+
+        # draft-ietf-lamps-cms-sphincs-plus: use SHAKE128 with SLH-DSA-SHAKE-128*
+        ok(run(app(["openssl", "cms", @prov, "-sign", "-md", "shake128", "-in", $smcont,
+                    "-certfile", $smroot, "-signer", catfile($smdir, "sm_slhdsa_shake_128s.pem"),
+                    "-out", $sig1])),
+           "accept CMS signature with SLH-DSA-SHAKE-128s");
+
+        ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig1,
+                    "-CAfile", $smroot, "-content", $smcont])),
+           "accept CMS verify with SLH-DSA-SHAKE-128s");
+
+        # draft-ietf-lamps-cms-sphincs-plus: use SHAKE256 with SLH-DSA-SHAKE-256*
+        ok(run(app(["openssl", "cms", @prov, "-sign", "-md", "shake256", "-in", $smcont,
+                    "-certfile", $smroot, "-signer", catfile($smdir, "sm_slhdsa_shake_256s.pem"),
+                    "-out", $sig1])),
+           "accept CMS signature with SLH-DSA-SHAKE-256s");
+
+        ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig1,
+                    "-CAfile", $smroot, "-content", $smcont])),
+           "accept CMS verify with SLH-DSA-SHAKE-256s");
+    }
+};
diff --git a/test/smime-certs/mksmime-certs.sh b/test/smime-certs/mksmime-certs.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Copyright 2013-2023 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -67,3 +67,16 @@ gen smdh.pem "/CN=Test SMIME EE DH" dh_cert >>smdh.pem
 # EE RSA code signing end entity certificate with respective extensions
 cp ../certs/ee-key.pem csrsa1.pem
 gen csrsa1.pem "/CN=Test CodeSign EE RSA" codesign_cert >>csrsa1.pem
+
+# Create PQ certificates with respective extensions
+$OPENSSL genpkey -algorithm ML-DSA-44 -out sm_mldsa44.pem
+gen sm_mldsa44.pem "/CN=Test SMIME EE ML-DSA-44" signer_cert >>sm_mldsa44.pem
+$OPENSSL genpkey -algorithm SLH-DSA-SHA2-128s -out sm_slhdsa_sha2_128s.pem
+gen sm_slhdsa_sha2_128s.pem "/CN=Test SMIME EE SLH-DSA-SHA2-128s" \
+    signer_cert >>sm_slhdsa_sha2_128s.pem
+$OPENSSL genpkey -algorithm SLH-DSA-SHAKE-128s -out sm_slhdsa_shake_128s.pem
+gen sm_slhdsa_shake_128s.pem "/CN=Test SMIME EE SLH-DSA-SHAKE-128s" \
+    signer_cert >>sm_slhdsa_shake_128s.pem
+$OPENSSL genpkey -algorithm SLH-DSA-SHAKE-256s -out sm_slhdsa_shake_256s.pem
+gen sm_slhdsa_shake_256s.pem "/CN=Test SMIME EE SLH-DSA-SHAKE-256s" \
+    signer_cert >>sm_slhdsa_shake_256s.pem
diff --git a/test/smime-certs/sm_mldsa44.pem b/test/smime-certs/sm_mldsa44.pem
@@ -0,0 +1,99 @@
+-----BEGIN PRIVATE KEY-----
+MIIKPgIBADALBglghkgBZQMEAxEEggoqMIIKJgQgmsSm9eI30++j5lPGc4VSUHl8
+RHdUYZ2HyINZ2noG/FsEggoAdnnaWN8r8QxVgVFSizuW+sZ0zqlCUOM5HFD0RYnm
+ueIk3OZUr/c53pCu4pz8eiyfhhlwToeroamymUVGZF984cjWlyIbK7sm0WwPstIw
+4cTMACIvOBspVFrxHib0IoyIb8RdM0a8EVdE7+5gUuwm3fwZ/TjTpi1PW+k2L6zP
+z5AhF0gTJIUjwmUEBQVCABECh2WKtonKQm0ZRS1byIHhMCFQCIlYEgoQo00SAxIA
+AokMBGLUNGYAAmAKiYXMNCIYhGmQMpEIsGQJAUxUMIyMQJIKKSHYwDHUpogUICIY
+NiDkqC0Uo1EbMyjjCC3gRIgZFSBgyAkasWEZBnIDOZAjwzBDGCxhGGnbQElLQoHE
+BCUkRUAJISwUhlESRXKLxgHMRhBKFEwBsGDKEgqQEg3JCI1ICCUjyU0UtpCSBAmb
+hmDbBoGRpm2BlAkQx0jDMoGAQiVKRkQIKSHJkAWKIiYCqUSSsCiTOCJQQI1BJi1C
+MJIZQIBLsCyUpgiYECAkRJDbCCwYQCQDR2nbhGgZCC6MAiRjpGWBNgnCQmzbEAjb
+mICYOIjUIpDIliwZOW6Eom0LuYkkSBLksm1iEiRiIlECtiWAAnCiMCkSMZESkQ2B
+AALjxJFgRGRbFAlMNGwLpknLMDFLImjiFmQIgGCDAo2kJErhRFALuSiiAg5QKAFT
+OE6iFgwQSFBCCFKLSALRwGRkAIrjAggjgIWKhkgkhmXkxIULgpHZBFAAFUwbCW0A
+RAHIlCkJljGaQoBKIpLRoDEbFIVbMAWKloEIE3GjGGYiBCxMMEESMCUDRWlAomgS
+NXIkNjBaqECbsihAEinAlokZyQDJBoAQpFEMAS2DAFIZtgiQtBAIoGkaRHGUmCDR
+kkkRhRHEwiTYtkkgOGFIgmGcgo0TskkQRCQTEUxiMGlQSG1SIoqiCG6kpCXcpAgK
+xEgBxRBgRihZRHGgAkQBqEEkgi0CNymQKGBQiCmJMIwQkZEZRA4IMC4YRXAKGU1c
+pgFYFCXLRoBBSAESM0IBQWnAxgGbwoghRUUSESpBogRjFI4Ig1FaEI7jwAHbxAjj
+IGLAhmzSBGIIQ0pTpE2gMo5bqAxMtCQLxhGCMAjcsIkRRkFTRhEkpwiDGGBDlgAU
+BS0iNTIRhSkiQ0kIuIxRwGiAQmwRtHAZt1FQkAxLlE2RIkEZtiEJImpcAmwCQijE
+sgFeAKKEuHpy3oMPABBvFJQoBB5V1/+oelrPmUyEuaDw3/Yrlh1OM28QYLO0tbBD
++Xp9mDfAOF9jT/RT9x5QZUOaVfCctxPAkzfXwX9SZ9ClyOZwOGzB64bfxXw6EEvB
+37tO8wBlEtddXkpsQ/cx9C1nuMxGmlscSiA6L0pRkNme7JneAjDKY5IDVPrMUkoY
+wjNtI0CQ5FrE9E0PnbL7Sj+671QIZM77HA1FUOxbmqcKOtSeZY9QrEezt8plwX+8
+uY8QTr0mUcvVODvO5498J/qBTnlQrjLBx2SxyeYIYEClfdO8nWax4VgQT7ZMK/vR
+if0ijT+Q0qx+UYyEdALMp8US8d64njeggh3L6m8TX6+y1I9ezAi14Q8ofH4lSoWL
+o0YDlsi41LWxyHJDr88Nyd7ordFFp4x+yChxHJYoxxJOezP89uLev526aP40oUsL
+i3wXbFd+7g0p8rXl4PYBAcifxj/WBVUk9oa1MLdkKO54PTFZWFLWqnVVMgFS25w7
+Ldf+41pQUVP8RzfpyDvoHIsNNhrgZ8fZtssVtj0OBAsSQ1u5TJZjJDwXSh6LLUsW
+QpFeWS5Jw/gaZG9K3IuMjSDGvqTYL+CewC7AYH+B7S6Gc7bgtbu71osE/U2hHSfo
+nDGFdAk9se5RCfTiv7L6XquAqNvraZPOhlgX0dYmX8GpTgNNs+ryu/q8BdxnkiQO
+uUBjOxC4rKKNip2pOdVVpThIlGW03nE1oPiwW06HMmkfinto8dDN14a2hp1Zg+4B
+vNunwUU/sJ3OeHIxiOkCvEbORb+TUwwJGyHMmT7b+eEgYMoX0awAUP+QGBtNtHFi
+0cDftErapblEwsZEjBNurYF/XGijFUp03q/L/KN2obHTjg/rwLiQa98J74CSLJAh
+qUwWoqqhh6NGYb68ysT35xfZcf+OzhK0U26GGDIoqCqyOVU90YD2qQrGG4DGGH+i
+Dxjn2x5MjArscY62chnMcsgIesdlZfoHNOeGA0j7hD1u+OkBksOH5h6IJ+vl69Xv
+8Gg6Hw3R03TsifCaOg3TfoZ6vsczgKLeHxqJVcKWAsQmaBqFNsFYeZGjTGOGe85I
+yR46NvKXITVgeiyKDF743XctQniZrg8zKTygkERZELsB9lZd3l+qmdjY9Sk+1G7r
+mwpVfONDIpZmJUvLhrz8la4wwcaTKov5ib1KESQLbti4vTtM00LV4fgNGdlpoGsd
+9KTEOUi66j1ES82N16fClA53ULSlathgi66YgGu/1MHDc39zG5W1fUMcDPW3ufgv
+0u35/FvF4POrcAcx37n8bzLmqk2/+j4d39DUuViti9QFctK2jsbtQqthjRhRcaat
+l86Pn2f+fZHWhr7tQGx8bMcQnqVmVfMm6osQoaKNqdrrIQ9ACDVQlpSVIpR5bCeG
+CzcQu09NFS+GsESmZyMm5B2/WDPno6U5cGF6vP9v1oyrJt+/O+5Bwo3U6i+RRnkJ
+73AhkocMF4cIPBVtslMPwDK1dP3tlbp+e0dvq/vKdELIuoFY4Tyw1OAawXuwF85J
+MJUctKM44X8LMeADxPJvJN5XLYKCRCunoA3+MSUIHQT5oy2czouIwWKIv+F7FI/D
+8SBa9klkCT6mZrAKL1YCRg2WxjLzlgB5Tw4TEEi3FUlD6s5sCPT4OxkzaVqaWvpU
+9D2Vd4HfY6p0yjJiuLUjR4cjrRCJBP3A1XTYWvRgSu7uUqjK6z5HgkwWBJlZisJ7
+U1W6YCmWHhwC0Y9mjGahXPJx4FhA5btLX9EYCB9whTyBXicM6MrSa2aM5jCo9JIf
+ExDoCqBpDmZ+5kjFyDeTtYyUtwWCU+9tIKvtmFGYnzdERTf8w/vWszU6QugYn1FW
+WB4fGc/xKOz58xIm/I2B7NnQxmA5HvAEHDvF9n2mrHMRUYkoSsMjUhSAg1scMAFP
+vmvaQQ+AWOylhYQaQgx41y2oTw+9Iievm0hg2lB9qDORem/nwx1a8+4gP1wfjqSW
+xwiUz0Cy/0TtTfZrZGqxQtn02OIKInBpabGH0RSTtBPruNk/XotdSVm5uSN9mBQE
+2xiPnjF48auRYIUH8giNNN7MjZ4z5T40+mJHctegwllavzWKlEjTI5sC8g/pSkJV
+CD8i49DLVGf5sbfEAJB2xDW2f+6l65SpJYV7dY0dhK7R2KT2NrqABk/7w/6wb7VY
+bPVseTnHfXpVTRGdUSFLb5hyaNTiWFlMTX0OmfqQ6R9iOA==
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIHYzCCBkugAwIBAgIUTrKnsAj5Isy6498h/MK7WAAxIQEwDQYJKoZIhvcNAQEL
+BQAwRDELMAkGA1UEBhMCVUsxFjAUBgNVBAoMDU9wZW5TU0wgR3JvdXAxHTAbBgNV
+BAMMFFRlc3QgUy9NSU1FIFJTQSBSb290MCAXDTI1MDMxODA4MzIxOFoYDzIxMjUw
+MzE4MDgzMjE4WjAiMSAwHgYDVQQDDBdUZXN0IFNNSU1FIEVFIE1MLURTQS00NDCC
+BTIwCwYJYIZIAWUDBAMRA4IFIQB2edpY3yvxDFWBUVKLO5b6xnTOqUJQ4zkcUPRF
+iea54lR2/8XNOhJQ4oWszhrbSHpB1+DZ76n1tez5wc6N5X6s3BEOsp+IPj8W8D7F
+ppWAqoCvbHHflfEVh8mvy4MtPUVGf6XoIl9QgV/afzTZGec+G7GytiEHNBhld2Yq
+POfKPP/IK9mPbnFcPUpPscbHX84TFq8IM6VLgoFnakbQuID/G71nPTFo9f4k3EcT
+kVGIQnWK4lgQW+1WDh8yamFnvg+Du111jA1/c5So3EH++DJDspq03/ALgbMOROuN
+zSYPt6w6EVnqyx8sTWL52lQGx23Q0T8H0WtITz0KbGjgrOsfkrR1qL7DXP8aC83i
+LKMZMitt1OpsKngyBRdQ3fuBOU/bYkmyaWnMR2MuC40XNnKzd41IpO2mjAOyVhe+
+WlhDgABOzsxOjC/WI0oHYTOewTSsjqQhNYU513poeyC5g00QrJYt5HqCwvlPRCb8
+wCsc4ahj+NIdVCOR9KrPh0aXVqQn/Yz7njL76tzQezX7gaoSr3vhr6eQ8In/75bD
+UFRVSJW/6A0sVnQXc4dKyHQQMl9vVTWvoeM8njgMrwHsUT0fjKdJQQGetKGKl1YL
+L9kTnHMem8Zo1gwhs51iecIzj9hwN54ZoawidJy0CNt81Pzin0OaqH8MuI8/RaYy
+3LYMgswpsAXpwYHRY9R4BzrvVXLlNusuba4fHK6x5shr2pDFKe6CJOl5OgsIp9nY
+7+YkIuqOXEMtPrLFNkpgReN0Wj8i5+kNm6V4rviF5Bo67d3dNeIK68O+ZJQditdr
+wixBwhshLTZNp6UzYUJ7ZrfIZoj4wOyDEzWLO9Je1J3bcJzRUVt2hH/DN/Buslrj
+2md4X/MYJjAGQyzBYVVxf9HIH409JPOlb/J4uhL7oeTymdD14wtf2khZRq28kheO
+I3169hxfQo2sq05Me93J/nAglPXstMIPLKIW//544tkluzjn0CoCaHH6nS749TmM
+4QcEQ3ttPy7PmhjAJii+tJ08OoMdVwZ2UWH8R5FwEN4sF0Yb4CeM18AjWS45QNBR
+GDDOoCCN9BnnblyKd697L99KvhrQTy0v9XNXH6BFzuuAyPQ5khlgnlsSJyMhnTMo
+Zeh8WCu+zC7+z4vEAYJlMRVmKMIPH/GqPkNDhxTMc+FSsKSjEOfkZQh1JZ38oOdO
+RM4FJ4htsMHpn2g8OQuGSgUQo5dyqLpB8k/6sY//pGua3Y/PGjeBdYpydTUzAprU
+YMuFxVe+ymDSpQrB9OALRe9UwPbiUtaVJHlRchX7H1YB+RX6zywHH2sTD5NQfcwm
+3/To0Fe1Xw3dVczekXqN246GetDMwy4RYp1RsPIBRICaAwGEuDs1gX9aM5tLLaw1
+3RpF76+JruAICXZ2v8Q7wHZkM+MPZ6E4/l4zjXk5PJM/R3SfuOdQiEICbmmp8GL8
+c3Scu8Pi4TSvq0ajrpnKo//aNPaVJI3DQWDQf6+h29QyHqrbpjZ2nkrMmT34aVUl
+R0XI95qdjAB4U7neWx3AZVQd+MhP76aXvB/DvefVfnGOn2hQQd77VC9EB7FwTk5l
+m+DGBzzI1C5nKTfeTIeTdG69VB5BmU/AitRzu90X3ef2IrMuL+kIzWsPFixaqRX5
+7WFHx76mwanDgxgHgbNh5/AuVHT4nJ2bBe+U2fR2Q+ggVWwjs+gGUZLLby8FLOl/
+WRrb2shpJIs8yl6ReeaMj9j3NlpHQ8ETfslf3g0f1kPLJBrWo10wWzAJBgNVHRME
+AjAAMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4EFgQUlJUkGXaMnS/r8k6VzIDQ3EcK
+TBQwHwYDVR0jBBgwFoAUFcETIWviVV+nah1XINbP86lzZFkwDQYJKoZIhvcNAQEL
+BQADggEBAEgW7XK6cZJcSdRTIuRTbZ9ssJZj6WwLYJmygldKQg6hnYWpPYLNCxqb
+AOO2xicCa9hv3HkgvyYK1tqbwFtuef/KSk+wOlDfgqtFVryVyK0js3x5r3mpCbmk
+5ihpTIuSVTgMCFlx4AXgLZGacei7hvCCP05bnhUvQmdu96bKnwlxvjLHgn3X5Cfw
++7b0q60oZTkOn4PStVnuOVTgLzs6Ta/KHh5M9OVVyEsRz2m3lmG2idXX/pTWXkE3
+VNSJCepP45RBFuxPSeEHW4EM/JPDqhBY5H19NHxcM42uXDykpR1ChSIhKruzjijA
+wme8H314QJnFKfUcGNNrNN/dElirhmU=
+-----END CERTIFICATE-----
diff --git a/test/smime-certs/sm_slhdsa_sha2_128s.pem b/test/smime-certs/sm_slhdsa_sha2_128s.pem
@@ -0,0 +1,19 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMUBECT5RmZe6OO8vsKNkthvx+UPRB8d7wbvTJB1UgM
+zLwGZWYszdtLdA++kdkjuW5vJNeZVVKuVhhsqT7/bm5Rdz2I
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICZzCCAU+gAwIBAgIUDjFC0337VoVD3qOifcn8/v6cYSowDQYJKoZIhvcNAQEL
+BQAwRDELMAkGA1UEBhMCVUsxFjAUBgNVBAoMDU9wZW5TU0wgR3JvdXAxHTAbBgNV
+BAMMFFRlc3QgUy9NSU1FIFJTQSBSb290MCAXDTI1MDMxODA4MzIxOFoYDzIxMjUw
+MzE4MDgzMjE4WjAqMSgwJgYDVQQDDB9UZXN0IFNNSU1FIEVFIFNMSC1EU0EtU0hB
+Mi0xMjhzMDAwCwYJYIZIAWUDBAMUAyEAZizN20t0D76R2SO5bm8k15lVUq5WGGyp
+Pv9ublF3PYijXTBbMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQW
+BBThF4u5GJ2SIU/Uq8ZC97+3tZMX6DAfBgNVHSMEGDAWgBQVwRMha+JVX6dqHVcg
+1s/zqXNkWTANBgkqhkiG9w0BAQsFAAOCAQEAajeFlF3LMr6Z3i0YF+guYeY7+o6O
+Q7VVBKyaFWfb+m8IMo0iM7fvYeP1B+VXRO0bPrvCE8jsgv+kkZn5PUTkZApaLbkj
+eu0Pj1ik4/A7/en3aGGjzHRGrcjScE18SPrB8KtoDWuq7nb0PQX1LPDEJLAkJt8F
+qD4uGGHXkFHse2IE+wlCXC8xOoaMmVmdbCz+lz1TNIpmFYAgv9gsMOlEDN/lcFL4
+DGebKespZapcDBVROVWZceOSY/3o8CdnFjrsm9F/q6SUoq08Lf595+THace+N1nB
+rYn6Enlx7OLoONpjsas50h28tTKKnuFHFd+emD7ga3GEwjDwMnOQ2bOFrQ==
+-----END CERTIFICATE-----
diff --git a/test/smime-certs/sm_slhdsa_shake_128s.pem b/test/smime-certs/sm_slhdsa_shake_128s.pem
@@ -0,0 +1,19 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMaBEBtEDfB3z2GkApieWwYEcUwym4LqAn+f3ekIXpy
+3Ih301cGLuxKkbFlC18GqkEFy2hrtjlDrRImYToCJ1S4HlzY
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICaDCCAVCgAwIBAgIUP4qMOjsrV/JbvCEgSaqBovSvz1cwDQYJKoZIhvcNAQEL
+BQAwRDELMAkGA1UEBhMCVUsxFjAUBgNVBAoMDU9wZW5TU0wgR3JvdXAxHTAbBgNV
+BAMMFFRlc3QgUy9NSU1FIFJTQSBSb290MCAXDTI1MDMxODA4MzIxOFoYDzIxMjUw
+MzE4MDgzMjE4WjArMSkwJwYDVQQDDCBUZXN0IFNNSU1FIEVFIFNMSC1EU0EtU0hB
+S0UtMTI4czAwMAsGCWCGSAFlAwQDGgMhAFcGLuxKkbFlC18GqkEFy2hrtjlDrRIm
+YToCJ1S4HlzYo10wWzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4E
+FgQUO+o1zTM0Z+/LQz6qk3AWGA1jlTQwHwYDVR0jBBgwFoAUFcETIWviVV+nah1X
+INbP86lzZFkwDQYJKoZIhvcNAQELBQADggEBAEumBy00rMY5HqpqoTRjVj3TNhXH
+i42pLoOXkAlNDpyHAkn5nM4iPeefHOha521RYiIIPv8XZIiAixHtZJjXtZnMgD6G
+XsdCtci82Lgry/6pzg3hPb/LuaC7ochG4RSNv6QdIFgB+YcD6qaQnvtWuK3zsMQQ
+1Fr2qGRljbgDdreaViIJxEXYakXnHvLHYn9UOT8punXsM6jksugvt8wysUucHMA5
+KhB1o1yYgXFbE3IcAmsX8cQpIDHwSPDdnYmxBptTKld3SOKt0O0TjLzjgix/3IQm
+8l1MHH0UEuLdhXCOiSbQiXqYfWJig+2AmM5VLeWAysX6BixVKxG25jSsAZE=
+-----END CERTIFICATE-----
diff --git a/test/smime-certs/sm_slhdsa_shake_256s.pem b/test/smime-certs/sm_slhdsa_shake_256s.pem
@@ -0,0 +1,22 @@
+-----BEGIN PRIVATE KEY-----
+MIGTAgEAMAsGCWCGSAFlAwQDHgSBgG4ItImtx5rfHYI99Xo2Wl4PSpqyeMaZrjtW
+QYKovvW2pKvcIc4Re7OnKKHMjIvow/1TaRQUHRUQQFQC/DygeacNpVdWjGZ1/jnc
+D0XfWgfvX0KwATwmXO9NM7Rq7B5OZ1uyykT3e8mPhn5afbRkNvfhKgID07Ukiz1c
+/6XQf7nU
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICiDCCAXCgAwIBAgIUStYfQbEa4PtzChfKNmTE65EId3YwDQYJKoZIhvcNAQEL
+BQAwRDELMAkGA1UEBhMCVUsxFjAUBgNVBAoMDU9wZW5TU0wgR3JvdXAxHTAbBgNV
+BAMMFFRlc3QgUy9NSU1FIFJTQSBSb290MCAXDTI1MDMxODEyNDExMFoYDzIxMjUw
+MzE4MTI0MTEwWjArMSkwJwYDVQQDDCBUZXN0IFNNSU1FIEVFIFNMSC1EU0EtU0hB
+S0UtMjU2czBQMAsGCWCGSAFlAwQDHgNBAA2lV1aMZnX+OdwPRd9aB+9fQrABPCZc
+700ztGrsHk5nW7LKRPd7yY+Gflp9tGQ29+EqAgPTtSSLPVz/pdB/udSjXTBbMAkG
+A1UdEwQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBTSJYn48biBTinA1pDo
+k2odLpFi0zAfBgNVHSMEGDAWgBQVwRMha+JVX6dqHVcg1s/zqXNkWTANBgkqhkiG
+9w0BAQsFAAOCAQEARP3DGNCSUHkAsQCgWgIF50k3qe8t2cjFnpMBdpoSTFo0VSIo
+58cCN0yusCzHvrtVSXXf/B9t4kLunmXKH5+4nAbnc7Yi2PxiN30qPfr1XYqfKcUd
+k04xB7pJF1YjNqVOlrPSA4O5Mi7aXgmkv7pyHFbY8056u1Ea3xcm2Ib5cpCBQd90
+47ARf8XH/94zhBebFALffrWRn1NgsOgwSq3GAZSvEkWpZHyr4XWpCvHXZ0ImfghU
+BqM077E+r/uLk3kT+L1FoUwLXtQkNrtWJtrSBdp5AexOZqqjqjRR+oG9tAG1KUnl
++4+ts3nVjUeEsRdGMv+gl3/926nsxozJtUO5OA==
+-----END CERTIFICATE-----
