[API Proposal]: Composite ML-KEM CNG identifiers

[PranavSenthilnathan]

Background

Expose the Windows Composite ML-KEM CNG identifiers so callers do not need provider-specific string literals.

Edit: Updated proposal to not include blob identifiers. They can be added later if people request them.

Related: #129633

API proposal

namespace System.Security.Cryptography;

public sealed partial class CngAlgorithm
{
    [Experimental("SYSLIB5006")]
    public static CngAlgorithm CompositeMLKem { get; }
}

public sealed partial class CngAlgorithmGroup
{
    [Experimental("SYSLIB5006")]
    public static CngAlgorithmGroup CompositeMLKem { get; }
}

Documentation

• ML-KEM and Composite ML-KEM key blob structures

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[bartonjs]

I don't remember what the criteria for adding public CngKeyBlobFormat values were in the past... but I'm definitely feeling like they're not needed.

I'd rather leave them out and add them in when someone wants to argue why it's not super-niche.

(For contrast/comparison: CngAlgorithm is important(ish) for key creation, and CngAlgorithm+CngAlgorithmGroup are properties hanging off of a CngKey.)

[bartonjs]

Video

Looks good as proposed

namespace System.Security.Cryptography;

public sealed partial class CngAlgorithm
{
    [Experimental("SYSLIB5006")]
    public static CngAlgorithm CompositeMLKem { get; }
}

public sealed partial class CngAlgorithmGroup
{
    [Experimental("SYSLIB5006")]
    public static CngAlgorithmGroup CompositeMLKem { get; }
}