Re: Python script to generate X509/CMS from NIST testcases

[Stephan Mueller <smueller@chronox.de>]

Am Dienstag, 20. Januar 2026, 16:04:15 Mitteleuropäische Normalzeit schrieb 
David Howells:

Hi David,

> Hi Eric, Stephan,
> 
> In case it turns out to be useful to you as a template, here's a script that
> I wrote to package NIST ML-DSA testcases from JSON files into rudimentary
> X.509, message and CMS signature files and also to produce a C file that
> contains those blobs packaged into u8 arrays with a table listing them all.
> 
> It also tries to verify each testcase with "openssl smime" - except that
> that doesn't work too will for ML-DSA (it did work for RSASSA-PSS, but
> that's another script).
> 

Thank you very much for this reference.

Also, in case it is useful for you as well: I just completed the work on 
adopting the sbsigntools to PQC [1]. This would support the adoption of the 
shim bootloader to use PQC algorithms that is started at [2]. The coding in 
[2] is completed to the extend that it compiles as PE/COFF executable. Now I 
am working through the testing and adopt it to use the updated sbsigntools.

[1] https://github.com/smuellerDD/leancrypto/tree/master/apps/src#secure-boot-signing-tools-supporting-pqc

[2] https://github.com/smuellerDD/shim/tree/leancrypto2

Ciao
Stephan