Skip to content

Support SHA-3 for HKDF on Apple platforms - #136879

Open
vcsjones wants to merge 4 commits into
dotnet:mainfrom
vcsjones:hkdf-apple-sha3
Open

vcsjones wants to merge 4 commits into
dotnet:mainfrom
vcsjones:hkdf-apple-sha3

Conversation

@vcsjones

@vcsjones vcsjones commented Nov 2, 2026

Copy link
Copy Markdown
Member

This implements SHA-3 for HKDF on Apple platforms.

This is the "smallest" SHA-3 feature we can implement. Let's start here to see if we do indeed have CI coverage. If successful, the rest of the SHA-3, PQC, etc. work will be in follow up PRs.

@vcsjones vcsjones added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Nov 2, 2026
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

@@ -81,7 +81,7 @@ internal static unsafe void HKDFDeriveKey(
{
Debug.Assert(!destination.IsEmpty);

PAL_HashAlgorithm algorithm = PalAlgorithmFromAlgorithmName(hashAlgorithm);

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PalAlgorithmFromAlgorithmName is a shared helper used by many other things, including things that will not support SHA-3 on Apple (Like RSA PSS). Make an HKDF-specific map for now so that we don't light-up the algorithm elsewhere unintentionally.

@vcsjones
vcsjones marked this pull request as ready for review November 4, 2026 01:09
@vcsjones vcsjones removed the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Nov 4, 2026
@vcsjones

vcsjones commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

SHA-3 HKDF passes in CI so we have test coverage.

Image

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant