Enum PublicKeyDetails

Namespace

Dev.Sigstore.Common.V1

Assembly

Sigstore.dll

Details of a specific public key, capturing the the key encoding method, and signature algorithm.

PublicKeyDetails captures the public key/hash algorithm combinations recommended in the Sigstore ecosystem.

This is modelled as a linear set as we want to provide a small number of opinionated options instead of allowing every possible permutation.

Any changes to this enum MUST be reflected in the algorithm registry.

See: <https://github.com/sigstore/architecture-docs/blob/main/algorithm-registry.md>

To avoid the possibility of contradicting formats such as PKCS1 with ED25519 the valid permutations are listed as a linear set instead of a cartesian set (i.e one combined variable instead of two, one for encoding and one for the signature algorithm).

public enum PublicKeyDetails

Fields

[Obsolete] [OriginalName("LMOTS_SHA256")] LmotsSha256 = 15

[Obsolete] [OriginalName("LMS_SHA256")] LmsSha256 = 14

LMS and LM-OTS

These algorithms are deprecated and should not be used. There are no plans to support SLH-DSA at this time.

USER WARNING: LMS and LM-OTS are both stateful signature schemes. Using them correctly requires discretion and careful consideration to ensure that individual secret keys are not used more than once. In addition, LM-OTS is a single-use scheme, meaning that it MUST NOT be used for more than one signature per LM-OTS key. If you cannot maintain these invariants, you MUST NOT use these schemes.

[OriginalName("ML_DSA_44")] MlDsa44 = 23

ML-DSA

These ML_DSA_44, ML_DSA_65 and ML-DSA_87 algorithms are the pure variants that take data to sign rather than the prehash variants (HashML-DSA), which take digests. While considered quantum-resistant, their usage involves tradeoffs in that signatures and keys are much larger, and this makes deployments more costly.

USER WARNING: ML_DSA_44, ML_DSA_65 and ML_DSA_87 are experimental algorithms.
In the future they MAY be used by private Sigstore deployments, but they are not yet fully functional. This warning will be removed when these algorithms are widely supported by Sigstore clients and servers, but care should still be taken for production environments.

See NIST FIPS 204, RFC 9881 for algorithm identifiers

[OriginalName("ML_DSA_65")] MlDsa65 = 21

[OriginalName("ML_DSA_87")] MlDsa87 = 22

[Obsolete] [OriginalName("PKCS1_RSA_PKCS1V5")] Pkcs1RsaPkcs1V5 = 1

RSA

[Obsolete] [OriginalName("PKCS1_RSA_PSS")] Pkcs1RsaPss = 2

See RFC8017

[Obsolete] [OriginalName("PKIX_ECDSA_P256_HMAC_SHA_256")] PkixEcdsaP256HmacSha256 = 6

ECDSA

[OriginalName("PKIX_ECDSA_P256_SHA_256")] PkixEcdsaP256Sha256 = 5

See NIST FIPS 186-4

[Obsolete] [OriginalName("PKIX_ECDSA_P384_SHA_256")] PkixEcdsaP384Sha256 = 19

These algorithms are deprecated and should not be used, but they were/are being used by most Sigstore clients implementations.

[OriginalName("PKIX_ECDSA_P384_SHA_384")] PkixEcdsaP384Sha384 = 12

[Obsolete] [OriginalName("PKIX_ECDSA_P521_SHA_256")] PkixEcdsaP521Sha256 = 20

[OriginalName("PKIX_ECDSA_P521_SHA_512")] PkixEcdsaP521Sha512 = 13

[OriginalName("PKIX_ED25519")] PkixEd25519 = 7

Ed 25519

[OriginalName("PKIX_ED25519_PH")] PkixEd25519Ph = 8

[OriginalName("PKIX_RSA_PKCS1V15_2048_SHA256")] PkixRsaPkcs1V152048Sha256 = 9

RSA public key in PKIX format, PKCS#1v1.5 signature

[OriginalName("PKIX_RSA_PKCS1V15_3072_SHA256")] PkixRsaPkcs1V153072Sha256 = 10

[OriginalName("PKIX_RSA_PKCS1V15_4096_SHA256")] PkixRsaPkcs1V154096Sha256 = 11

[Obsolete] [OriginalName("PKIX_RSA_PKCS1V5")] PkixRsaPkcs1V5 = 3

[Obsolete] [OriginalName("PKIX_RSA_PSS")] PkixRsaPss = 4

[OriginalName("PKIX_RSA_PSS_2048_SHA256")] PkixRsaPss2048Sha256 = 16

RSA public key in PKIX format, RSASSA-PSS signature

[OriginalName("PKIX_RSA_PSS_3072_SHA256")] PkixRsaPss3072Sha256 = 17

[OriginalName("PKIX_RSA_PSS_4096_SHA256")] PkixRsaPss4096Sha256 = 18

[OriginalName("PUBLIC_KEY_DETAILS_UNSPECIFIED")] Unspecified = 0