mldsa support for pkey, pkcs8, x509

certs/mldsa/mldsa44-cert.pem

@@ -0,0 +1,88 @@
+-----BEGIN CERTIFICATE-----
+MIIQDzCCBoWgAwIBAgIUDF7BqnF0GUSKPxVFN9vkZcpngIEwCwYJYIZIAWUDBAMR
+MFcxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
+bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRIwEAYDVQQDDAlNTC1EU0EtNDQwHhcNMjYw
+NjExMjE0NDQxWhcNMzYwNjA4MjE0NDQxWjBXMQswCQYDVQQGEwJVUzEQMA4GA1UE
+CAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNTTDES
+MBAGA1UEAwwJTUwtRFNBLTQ0MIIFMjALBglghkgBZQMEAxEDggUhAPkkMDzuprwO
+4mbPvh0gEb5GWXNCAnEWFPaAfEUbhAIeiDEu5MaU6fovJ0nQ4YeJMD14J3w9JVsL
+HL70MtR3WPZOva44ix+FERGUcOiE9mO8dWm4/xF18H9NZyKPQBFeoPLHJFDZ0caA
+HKSnwZ2D/um0gHOWLwrR2qyPyLytJMAQ4wTEKujeEfC/Apu9tXDsj/YVR99C9IlM
+9ajiv+NFakpKHNhJAq9aKqITjisFttTFJjvnMC208h+DA87uybXUcdgq3vKcRCG9
+0Qfag3cbETqQwakKkXX9H4UeCi2Hn24PYquDfFSfrdLJ6r4ONEtT7c5/NLGRgdcD
+EDANJbIeNxhZfV5n1TSl4eKUC2mmw6QKCoWcBXNdvSR6GyG1U5NnjjnOsxRMj3V7
+7d/RT4SRO4k9zWfTDnTRda96zFYuBrsq44LbW7rwJZoG8YvF6ZDBwdv/VRGisyIh
+p3mg8cdSL6uyzDm9tTdenqXUCkxPmRbV/hQq7ML7WH+wYLZ01UocmKRgtJwThEY4
+knNCeVkuxQ9peveTrIInpXvFeW+zCO8j0IBIVMeBsvMnN+VIAAcEqtt/eIgppmbH
+qntFQ3HgN6qfLOBCRZFw6JHq76J/a/vlwndz0/4VkYbReYaTf1cdtCDT44a6ngSs
+1KKOBDHXDrkVUSuU59ae4jYBS5IJGIb+9LxAAc5W4s7fSdziZZjKvC9eHqets4Fe
+Fogwvz6TwJkcXq0NzHd67JTSaqfex0uH4JuMkN5l1OmEEXBxROkDF56B+Z8FpSKa
+Sn4vicHWArwr9pFvneB5GvwxHp6aa8twHpk6u0V1RcsEGUjVy73lN8isdZt0cUvl
+A9ydeTq7UKiwDWZQNVGqQtHZxNyK0gxQub2UkNpcOXO5y7RVaSSuOcP8bLBq94i1
+83VVyLhpnO/I0ZmcFXmWRjOeR5dZZA5lH4u76cVCkt4A5Kp+57Ty68xSDoPaHNFO
+cd0GMyClJKPaDkzag5oXl30SBgQ4+oWxZRjRj4unr1quJMIE+zv03t0A9POSiE7q
+Ozkwfk87xnoL2rlwg+ubyQsTb7YSGjpiHlIi6v4M+6At2o0jTh0VJ7sLzhmbSx+P
+VWr6HpIPlfogwHZn227iZLz+S0/g4vKXaNVpxey0a9JJY6hNcT/PHg76I9OPmtKo
+JcK19iqsRZRNMfC3naRI+D0dZA9MzyujjObANkvqFqXQp6enjp1Fiz/grVNp/V6c
+wei+1k8Y7cCG4O0J+n3ghkZS9KHtWkeFZvdWseT5UA2oM94oz3ArBvu9HUZKIT37
+rrqb3Xudny37WkuB8rpjwudaUIm8MU4dvcw9eVQn3XJl2wQQ/KTprV9pHcSQqc94
+qWUgVVJWA62tf+wmLI6H2QqPYPKH2/gVoTLbIkayQAxUbGu70DbSr5U2DUGBDfvN
+38S8Z6dopIeL2pdPJ2QiI5Xd/obeMn1oc+J2RI9SdoCLIp8Khwlpax8I5EeEZlGl
+pGcj6e5seaYGnZhn8tBnV7End9n8l7pddVjA6hFoG5XRnRqLEAmBWH8RIpZLj5Pp
+aRXwWGUA1FajcvY6yVyAvkk8Jz900EZc6qAIlGX3XmnMulymKl/hL5esAu+lGMiU
+dcslQMkQ2THRCSaEk+LqAMQ1jdrV2AGsZuf1b5VTQMcLedZfc2G8W62w8ieS2o5P
+eIBDL6j8i5qe4uqLLDjM/X3hWB6OxwOhwFANzAbhoJFs7lPLussW1f9PpA9XRz07
+vztHflUtx6KjUzBRMB0GA1UdDgQWBBSABbcbuiLr+ilzxhNup+Pyo396ITAfBgNV
+HSMEGDAWgBSABbcbuiLr+ilzxhNup+Pyo396ITAPBgNVHRMBAf8EBTADAQH/MAsG
+CWCGSAFlAwQDEQOCCXUARH77cfvbE77HYUsAAyV91hbSsWbqdJfbbzXtUcWrns4U
+oxh9w3zUNK8TH4YJOWhBNH2V/ggrUvMZR0LT65dy1AAp/2hzwihZkebJ9IGIwgPC
+bN+ZVXH027WbqWARVoopRv0WFUkEZxCwcZAhrAfz3OUMItDokk0XAVjb1c2eReR2
+wNaOpPVcFbbQNP7E1N++ZEh6NhnZ3n3zTl4XfclSZ0VsEaZDWZ+utSy+kukFQzEK
+Ut5Nypjbwmv0NCbnPiY3+qoMgL+iqVKIZvGdqceMlVAV3hBvX+vssl10YjKeQl1V
+G5HvyMZHC9lQripSR0zUjL/wqp/DoUcSKQzzU6MiIMAonVYoba6ed5GzuxXV1iGP
+JONcz9VE8MeYi32EsOXZJ065gek386IaGT2Z+5Y62CCDv9LkxrBKuYCiN5+Gafz1
+9cgd+WJ9V934Wk1mGeIXFxZlQyP4dKYkDCjKCfji/5wzagJVo7+9NgSjl3qHnVmO
+aydvSJ2Rp6/1tQcZWkrXzty5rDmxsSDzEjbXKqBNwQXJqItXRViXA4tnkFvBa5UZ
+5xYP2YAOAivjtoKZL+YMTbte01BsFtE2/DRGAVIlPlSnRPf984wGWpeK79dHfLTS
+cm6mKg0tPc+P91GYM17JtsO3hVmqmsioFuiqJU6BFdg5qIxxvO0P78NeTHviA3+F
+8MEbhzWrWQVi4bg9uNZwjM7rVRaDpBgdWKrkwOntfMEwK5YUsz4fT5iXfxYIt4Fg
+qO/uyd+dQkJOfeFokLVZXEEvlgyViFdIzd/DSZZfrm07lvbY8vdrkB6Pgqo+kA7j
+Ls2YvwwKJgR6ZytUoLUkLtj+/r1dbQzl+KeWMlMxgA1mJkm12fVZeYUoE9xNhLrI
+MBNCL6VXtuK/JhnZ4ajB/9S3K3gxsnva90XwWjYdgMGNN4ha1Ctrv1o0DCcx/Ub9
+ZyGMnCMUjJckz6ACGM0SiBd0ZEaQ32BNE/o92sScokQBfsuIj/VFk8bSSuyGA3tk
+U6xS4qFPv3T8mhDs/R33DZoqY9L9lJC0+zqC8rw4JkbZNRBoU3j8fOVF7Ee9cw7T
+WdEoiZ0LByr3ErwHgKeqDaPqPUj5wa+lWTuAkZG/rkyoe5Qi1UTFZtLRxmWvev8e
+KEefrD1Gdsb62TXKAr4doYcncyXy7djPZpPZKuTT5MbCPXWnzBdqycv+7qWTqua9
+ssqyZldAGI04x3BCm0H6itExodbbnLr7tydeW3lPWlO4ILb+WgeUWZxmep54TWf6
+KQG2HpvvbYEzuiE22pAIe9cFVYr9kFXOpnzrDmR6U7FWyglKDb7QGtjsHHS41kRj
+eda741M5hVzEURaMLEqrOnsDtxwEHj01HOZnPJQ1r9KvVdBWa3PkVnJ/SbPCaPtY
+UzcIQfmwqpP04CUdBOSdy4IB4mR4jg46YfDd07vzkOVOjfVKGfra4i791onSgSB2
+IfnXKpdtLCtWaPZMDR4mvZDbiD4n4Jdf0r3Gp+/3qCaVTRqrqz8upsMMuMYgXUim
+R9IKRT0T4CaV1xSnaLA4X236CBDjvwsu6fhgw4Jca1N9rnr7Gzwsmgpr+2MwyEku
+5R0cJxlw4ucNJ5r2WlDcyVEwmFrvTL5LXgub0BSEltOscZzmtK5Qn966mWyAxDFj
+YsS/M4JQPz4A8SJ1Fr8ax2r9sH7SyJDig+UX08LP+5W+Afx03RfHB/PmMRkoxSWp
+/5LA/XRvx8aXj0cn6Is1rsN1JpoW5Jo/nCMJ8BUHplr9Vi25ubdVzaMRAVTmbAS6
+t0bw7WTSvwsmOKm7qdmVu3/9ieuwNTACLlEa7tLLwU3OSO8/WLLqr1izvj6E6x5P
+yN5ENt4VXCZoVN7z4DGst7RGjVXRxVXNKY7NxgEBSxuQW5FfJ9cShmZKjmbG4EqS
+m/TxQufXDmxjDtwhr4DZJOM+vMxhGoZQA35Ug2qtN//MbI0ALneiCql34tEhPqlC
+iyy+OzNGXCy+YgruepOEQMvKCNuLf8dAYhzxZoG8RwGJyvr8UdzCgnMxauO2ehEO
+juevWcVNasbGpR7SeUY175vLgAShXF4I4/wUcIYNiyHlJnHlm3ux6qb9xhmvlvsi
+Va0swn8dl6gIYxPXW7XwoOTXHe6bWueNYtTm0kiHBEA2gaQn9w5P7MCYR/29wdXe
+20q/jXppi4B/3Hb/chlNqvpTlOb0KL2sHyMs2LDp/BUJQohE1xyIaGVOSdzaRQC/
+xhVJf9ytJ6EEVKF32zCBndbZMVRJVzGjSFxb3yA+VuN60zMGi71fKKj6g2BF7S8L
+kGSwZxPxwWrrRRMzYzxaZXwjGGmauNa7Z3Om24rJp8CD+r18pBHveAjvFgz0ArQh
+IJprCg00afwp+RSyiMY4g1nRfCcMiFANwmTZ2Kmd3manG/cgVVPKF3CvvSsl+xPf
+UWVyAF1p2XuFu4JL3w9/+SjCGeslY+a5YZ15smgYUu9bZz2HXYXQgV12sY3hIvzN
+TRXF7ngaUNuQyX1Q2jz09nvDLTptIIRjCS/FbhOLqnb42Dr5+w4kEo+xuTLLfRzm
+5Qlf0NCCrWOqHE5M0bQd9RuDn+daLqaIxrk8pBNWEuJMl8tzqI6bte0+4xBjFuQH
+EQsuP3jUjzIWSYC4yxQe0LCGEC4EgtNlcGJjmHLv4dwMDbi8RwM/Wy3gGemMbIWo
+Gy1dMNNKH6rdg5Czy00v7+EYSlNUlDglYJo8161r2k0queoQ7n8tPtatyoyLbluK
+otdL2hBd+ewuUMqe+2zgApTAOGplfu+rDvwnw1aCmxAAhJlF7FFWRHTF5Ag4labX
+3XJ9SBeWXXbD01LP0tYx59WsVY+aZ3CNBCmVlc4oepkwxi602WnyLvDpYzEKp3LY
+x+scuPvU9nMuvP1S/mqf5guG5uPd9gPRpkI33raDPDU9tw7aPq7r6h/uTvJRK3Yz
+IUqBaMfadVWdmo9Rm0TzWJdfj74bIAWwCR9M3y9HaRiv6keawqbq1VOsqWIFgzQy
+C2W4Ni8+dh9LycKHJaVTj95baJRkFS+nIoZF5nwoJysPBinT7ZZPawciOhaZykue
+agG5372BYYvCMrt40zmULlbDTbU+3loDiX/2HVqkQ7M5o6gSzThhN9O+V6sISSEH
+LTM9aG1zep7Bz+v1DBgtMkFPXIKJlafS3voZPj9ITVNWWGB6laTCx8gAAQUGCihb
+ZWeDhIi2u8fb4OzzAAAAAAAAAAAAAAAAAAAAAAAAAA0bKj0=
+-----END CERTIFICATE-----

certs/mldsa/mldsa44-key.pem

@@ -0,0 +1,57 @@
+-----BEGIN PRIVATE KEY-----
+MIIKPgIBADALBglghkgBZQMEAxEEggoqMIIKJgQg4nkpgTfvQgkEqtREw9UOaEyK
+0HGTAdDfaz69vCRlHMEEggoA+SQwPO6mvA7iZs++HSARvkZZc0ICcRYU9oB8RRuE
+Ah5aj1fuQ0sM8eYPXZUu58FYFZTo13OWzI34F/vwZtX6qXzNB/N3QTaGwft4JYZL
+yIzniSlF2kkSwFaADEDpTMU3tjjVKdThyYeZh+hwIFPPh7MxPmgEw6kQPH9xg1Sq
+Fk1bAmYcOS3YpGzDIBGQlhHREi0UGUYByWwjpyFkNGJiKJAgyBALF2lclhAThETD
+hkygQIzaFgxjkmRiCHAjkzAYwixKSAWEMgRRFBFKQoRkwIlZtI0MRAQayAzZFgLI
+yA0aESVJtlEiBmwahwjCFG7akCjSokBiOCzMFkIcQmgjhUwKRVEUhgnCxI2JSE0j
+yShAyG0INRIDSSFkKITjRFEUBGTbOG4BMybaKArLCAISRy7QMiRbCCDRJA0UE0oB
+F4rSmAwaEo5RtEgiBwKkNiYZFC0ZIXIitS0IlwkMgg2ARFCEmCTkxJEUJwgkhzHi
+NmggEw4Rl4WClCSkEGIgp1BbMGZBAi7bCCaMKA4KQQSgti1bgGQTsSBRoEHBgg0A
+GQDKAHDZJGCahjHSBBGLoJBDApIjyYTYBGnCAIaIlECUxInAGGlMtoiCpowMQgiB
+yGTRwpFASIBahBAKMAULuETIhAWMxgVaOHBiJEIBB2gQllAcE2EQqRFSKEQDEomT
+BImYEohEhIgipiUiQgRDpGGkqIQZkhBZJC6ESIZMtmGQQmgZRA2gwIWABjHCOAwk
+FoLEAi5EgmwKNWBhlI2awGAjQWhTwmyURkgMk4xQRmkDEhCQJEiSKAlMMIwhlBFg
+wgkRgkUAGTLiIlAglozAgAHktIhZACWagImUMihTACIkFgpKqEgaGGFRtGlYIoaT
+wERQuIgRAIkENSQiFAXQwAAYEEWhIDEMuS0JJQ2awA0SRABDwoyTsgAAqYmiJGik
+FiERRwaiAERTMCrZwE3DginjtGnTNi0jpGHZtA1UQCCERETIkkjIBGFMJpADCSrS
+EiYMOUDACEpYMDIhIyIkyGhkqERDRgUkM5ELwYxRMgkKgmAZAjBiAEoSEYUACG2J
+hjHRSJBSACUaIFJjEDHECITCSGniNBGkqAAhR4HQkHAkky1RkGABlw0IRiwiFW2L
+IAkjsGzhNFLQAmHEAo3cAG3YgnDMxETiRoAZAJKbAk4JKYyEMAgbyEjQlC0QhBFk
+Rkpg+PqdjkVKnCvgBltVsxYdtdtcHhbcMBWrz0NnqfOA3IAMWTP/JXyNk470oPPB
+gF1W3bLmgNXyHhGRNyCGC8wlVwN+Ax+D4P27y5PIHS1bMZObrpmnUQTh7l/yOHQm
+iIH9n77yXTTtUF6B3w5VC9QSWOpq6nGM2e1Zp1dQbq2+BcDkD0/N4gSDxdfEbNN8
+LpmmFlHCSKJSQ9AOkbYnkgb5YEEy+M9MMfxjA6FBUWpHc+omMWq9rXjKqslXTw9U
+lE42xvn2Pj/GRtsOJjKBHa9jmANyYdy5PZlTjDMXEuCH8aPcmdkpS6z39OQxG3Em
+bDq2YVQ/v3YIhveTXQTxHArqz3QNUKuu9P5x3uZ6k67MeLY53j7mNBzkIKisiEUo
+sqMkCGs83GN1N2gK9OxjXk3twpJWWoftWhkaWlJEQrjcpxAXFsCfOHXzneIINgTb
+9oBE90yiaWNDXq0AB35q7UcoFYNcscdDhn4t8an48hXX14PZ74BbC+yQcNGGvMqH
+db7FNmgSUvcnyePoZIEbugVXf8fely4Sj6pattYAM9a8WRRQzNfR/UZB731tVcLU
+f6bKHhV6PM4GJHR4tgunz3NcjNr/JBR02hFyXVe0348cjfD+JoDj4wEhpGv4a+y1
+8WJP4pHAcklrLkdyVcjcsiXVCflBb9bcoF2nOMCmpUsnOv4XrOXsR5Nk+fKjJR9c
+J/PqDHMit2RUZA0VwVNGuuqtjFIWCTpdWi6SSlF0YvIzZdLW5OyITBzmDFo1LwGX
+zigiukm3iiob7GG65CM9fb8qzJzLNrlSa4W02q9rbG5FMxNfARiskYRjHbhNqdGj
+9/C/9GpWvAPMLIVNcnx9Udv/mBYtBiBSa9UY/fx1g0fadESZp3mmHDm3qJOWyclV
+fP6s8tL+kmohuzKIZcYj12sJ6xDpaBArZZMdwYkMoQnWA8Hy8IlDjwcwXQi+IYZ5
+fbf22+/fZD3ARqxffdzw1p9Y1LS6V6skRlq2o50DihEpBg4cuO9JOPFc7tnbA8s0
+4VKGgop4l4gm4fs+gWVxJNVCVFiQ0Pn4mQgP3FxvXp6gdJe4HC7xknAd/h0DQqRk
+fwU3TIRU/w8QO38ugDIxxMGC33WL0sqhUP59NIK+WxM5/3RVugTFkZ0yow4RNULZ
+jcb/1mArz46DhAJILgld9j2iK0WlyBwmY8knHKnJQ8eJZ5XdWHZGwUf4C745kagk
+VIyKOJjMOUcgw04DWDd44lcqbjhsk0X7MIHJhu5p1jRhUPXgKxgsGQFPBB2gSrZV
+IGSk9V2T9tl/J4dpzP0qJagsPqDj89ZsO7Zks9/tdEZx4fosB9BR3CR2D1FPpXtX
+WwGGxa8LNdFDo1KXHyZpeCQbUVrw8s6KwlOb/andwa63Cb25luQ6ADDn8QwqbakA
+pxFRvBCqdCNfpM0gu6LX6jrwcvSw32ppQ7mZA4F+NLXxtVrqo64wgQ7Wqur70jNy
+W2Zj+6eZ4qQp+bfzqQTOdy08cc/24eqYPhHoNSUnRxJRrbwKNrvjTj0bBNP7TBey
+DdWddNh7GUpT8zdu58P82wIh8Zb70Y3y0Bk1zidgzTIl6k6545CFDhRqw0IhSbHu
+Ai2HjMP+5wgDXuDvfdrwYGY2ObuMwkhLFvGRmWFgRaWVQpxs++dxRVy/+G2oYo/M
+F3CQpcJXyN6wsEd4KX8dhgN1JIatWb3uYMM/jpD7pE0PyaCmYU7RcGqqpMLjloYN
+tS/27fqnaL8quJMuVwUa4aCe7mv8cjEPTY4/2qdKWzdedLF4rpN7Ml+VSEaMZQ+I
+d+HbmoMnh7oFm4uao+qFIkFMzsydfajJhEXTqUfI/AlmepQIffYaim4We5ta+YZV
+QjN+YZhLIfMB6kg+lNseG7J9Uad7+cxGrYXbcviZ5EmVL8h4JzG7vJ+A0+8J137i
+XmRKi/V7BZWr2yV3La/3sIirYJxtWXmMmAVcQgycjVX8+G8gahCKhijCb1mz4JjR
+V5G/yg6mjsxJLWqxZPM3IRWTUelHzZ14rEq9YLFY1vh6KDdkUP/5YOSdqdTTmQjt
+MfNu3DTMNTLsi9xtyDcjd1hFfQNNPPXarGQKCoVRavLbPI5JOGuEyvbQxH9Ou3IO
+hdqCSg2wiur7fCLhMF3q4SdU0I+0qwqiIUVRlZH6rKisAJ+BEwAO14uDLH0R1Bi9
+TCDPYU8VNQrV3nb8YH5onpylVWvU2y9LUgpqete3oN1r+Q==
+-----END PRIVATE KEY-----

certs/renew.sh

@@ -41,6 +41,19 @@ cp  $CERTS_DIR/intermediate/ca-int-cert.pem .
 cp  $CERTS_DIR/intermediate/ca-int2-cert.pem .
 cp  $CERTS_DIR/intermediate/client-int-cert.pem .
 
+echo "Copy over ML-DSA keys and certs"
+cp  $CERTS_DIR/mldsa/mldsa44-cert.pem      ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa44-cert.der      ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa44-key.pem       ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa44_pub-spki.der  ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa44_seed-only.der ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa65_pub-spki.der  ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa65_seed-only.der ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa87_pub-spki.der  ./mldsa/.
+cp  $CERTS_DIR/mldsa/mldsa87_seed-only.der ./mldsa/.
+openssl x509 -in ./mldsa/mldsa44-cert.der -inform der -noout -pubkey | \
+    openssl pkey -pubin -outform der -out ./mldsa/mldsa44-keyPub.der
+
 # client is decoupled from wolfSSL example client
 #echo "Additional update of client example source code"
 #cp $CERTS_DIR/../examples/client/client.c ../src/client/client.c

src/pkcs/clu_pkcs8.c

@@ -288,7 +288,7 @@ int wolfCLU_PKCS8(int argc, char** argv)
                 WOLFCLU_LOG(WOLFCLU_E0,
                         "Error writing from private key to pem");
                 ret = WOLFCLU_FATAL_ERROR;
-	    }
+            }
         }
     }
 

src/pkey/clu_pkey.c

@@ -56,6 +56,86 @@ static void wolfCLU_pKeyHelp(void)
 }
 
 
+#ifdef HAVE_DILITHIUM
+/* Get the DER encoding of an ML-DSA private key
+ * returns the size of *out on success
+ */
+static int _MLDSApKeyToPriKey(WOLFSSL_EVP_PKEY* pkey, unsigned char** out)
+{
+    int derSz;
+
+    if (pkey == NULL || out == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    derSz = wolfSSL_i2d_PrivateKey(pkey, out);
+    if (derSz <= 0) {
+        wolfCLU_LogError("Unable to get DER from ML-DSA private key");
+        return WOLFCLU_FATAL_ERROR;
+    }
+    return derSz;
+}
+
+
+/* Get the DER encoding of an ML-DSA public key
+ * returns the size of *out on success
+ */
+static int _MLDSApKeyToPubKey(WOLFSSL_EVP_PKEY* pkey, unsigned char** out)
+{
+    int derSz;
+
+    if (pkey == NULL || out == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    derSz = wolfSSL_i2d_PUBKEY(pkey, out);
+    if (derSz <= 0) {
+        wolfCLU_LogError("Unable to get DER from ML-DSA public key");
+        return WOLFCLU_FATAL_ERROR;
+    }
+    return derSz;
+}
+
+
+/* Write an ML-DSA key out as PEM.
+ * return WOLFSSL_SUCCESS on success
+ */
+static int _MLDSApKeyPEMtoKey(WOLFSSL_BIO* bio, WOLFSSL_EVP_PKEY* pkey,
+        int isPrivate)
+{
+    unsigned char* der = NULL;
+    int derSz;
+    int ret = WOLFCLU_FAILURE;
+
+    if (isPrivate) {
+        derSz = _MLDSApKeyToPriKey(pkey, &der);
+    }
+    else {
+        derSz = _MLDSApKeyToPubKey(pkey, &der);
+    }
+
+    if (derSz > 0) {
+        if (isPrivate) {
+            ret = wolfCLU_printDerPriKey(bio, der, derSz,
+                    PKCS8_PRIVATEKEY_TYPE);
+        }
+        else {
+            ret = wolfCLU_printDerPubKey(bio, der, derSz);
+        }
+    }
+
+    if (der != NULL) {
+        if (isPrivate) {
+            wolfCLU_ForceZero(der, derSz);
+        }
+        XFREE(der, HEAP_HINT, DYNAMIC_TYPE_OPENSSL);
+    }
+
+    return (ret == WOLFCLU_SUCCESS) ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
+}
+#endif /* HAVE_DILITHIUM */
+
+
 /* helper function for ECC EVP_PKEY
  * return WOLFSSL_SUCCESS on success */
 static int _ECCpKeyPEMtoKey(WOLFSSL_BIO* bio, WOLFSSL_EVP_PKEY* pkey,
@@ -135,7 +215,11 @@ static int wolfCLU_pKeyPEMtoPubKey(WOLFSSL_BIO* bio, WOLFSSL_EVP_PKEY* pkey)
         case EVP_PKEY_EC:
             ret = _ECCpKeyPEMtoKey(bio, pkey, 0);
             break;
-
+    #ifdef HAVE_DILITHIUM
+        case EVP_PKEY_DILITHIUM:
+            ret = _MLDSApKeyPEMtoKey(bio, pkey, 0);
+            break;
+    #endif
         case EVP_PKEY_DSA:
             FALL_THROUGH;
         default:
@@ -244,7 +328,11 @@ int wolfCLU_pKeyPEMtoPriKey(WOLFSSL_BIO* bio, WOLFSSL_EVP_PKEY* pkey)
         case EVP_PKEY_EC:
             ret = _ECCpKeyPEMtoKey(bio, pkey, 1);
             break;
-
+    #ifdef HAVE_DILITHIUM
+        case EVP_PKEY_DILITHIUM:
+            ret = _MLDSApKeyPEMtoKey(bio, pkey, 1);
+            break;
+    #endif
         case EVP_PKEY_DSA:
             FALL_THROUGH;
         default:
@@ -369,6 +457,12 @@ int wolfCLU_pKeytoPubKey(WOLFSSL_EVP_PKEY* pkey, unsigned char** out)
             ret = wolfCLU_pKeyToKeyECC(pkey, out, 0);
             break;
 
+    #ifdef HAVE_DILITHIUM
+        case EVP_PKEY_DILITHIUM:
+            ret = _MLDSApKeyToPubKey(pkey, out);
+            break;
+    #endif
+
         default:
             wolfCLU_LogError("unknown / unsupported key type");
             ret = USER_INPUT_ERROR;
@@ -402,6 +496,12 @@ int wolfCLU_pKeytoPriKey(WOLFSSL_EVP_PKEY* pkey, unsigned char** out)
             ret = wolfCLU_pKeyToKeyECC(pkey, out, 1);
             break;
 
+    #ifdef HAVE_DILITHIUM
+        case EVP_PKEY_DILITHIUM:
+            ret = _MLDSApKeyToPriKey(pkey, out);
+            break;
+    #endif
+
         default:
             wolfCLU_LogError("unknown / unsupported key type");
             ret = USER_INPUT_ERROR;