On Thu, 3 Sep 2026 21:05:54 GMT, Sean Mullan <[email protected]> wrote:
>> Add ML-DSA and ML-KEM default parameter sets for `keytool -genkeypair`. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > src/java.base/share/man/keytool.md line 1397: > >> 1395: * Modern digital signature algorithms such as EdDSA and ML-DSA use the >> same >> 1396: name for both the key and signature algorithms. Only the signature >> algorithm >> 1397: with the same name can be used with a given key algorithm. The specific > > "Only the signature algorithm with the same name can be used with a given key > algorithm." > > Generally yes, but for algorithm families like EdDSA or ML-DSA, it is not > specifically true. You can use an "Ed25519" Signature with an "EdDSA" key if > the key itself is Ed22519. > > Maybe avoid using "same name" and say "algorithm" instead. "Modern digital > signature algorithms such as EdDSA and ML-DSA use the same algorithm as the > key." (Maybe that is all you need). You are right. I meant to say there is no more "SHA1with" part in the signature name, so the `-sigalg` option is useless. Also, I think I should not mention parameter sets at all, which could only make people confused. How about this? * Modern digital signature algorithms such as EdDSA and ML-DSA use the same algorithm as the key, and there is no separately selectable signature algorithm such as `SHA1withRSA`. Therefore, when using such a key, specifying `-sigalg` explicitly is unnecessary. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32616#discussion_r3974168880
