feat(crypto): add NIST EC/ML-KEM hybrid key support

lib/ocrypto/asym_decryption.go

@@ -43,6 +43,12 @@ func FromPrivatePEMWithSalt(privateKeyInPem string, salt, info []byte) (PrivateK
 	if block == nil {
 		return AsymDecryption{}, errors.New("failed to parse PEM formatted private key")
 	}
+	if block.Type == PEMBlockXWingPrivateKey {
+		return NewSaltedXWingDecryptor(block.Bytes, salt, info)
+	}
+	if params, ok := hybridParamsFromPrivatePEMType(block.Type); ok {
+		return newSaltedHybridECMLKEMDecryptor(params, block.Bytes, salt, info)
+	}
 
 	priv, err := x509.ParsePKCS8PrivateKey(block.Bytes)
 	switch {

lib/ocrypto/asym_encryption.go

@@ -23,8 +23,9 @@ import (
 type SchemeType string
 
 const (
-	RSA SchemeType = "wrapped"
-	EC  SchemeType = "ec-wrapped"
+	RSA    SchemeType = "wrapped"
+	EC     SchemeType = "ec-wrapped"
+	Hybrid SchemeType = "hybrid-wrapped"
 )
 
 type PublicKeyEncryptor interface {
@@ -69,6 +70,17 @@ func FromPublicPEM(publicKeyInPem string) (PublicKeyEncryptor, error) {
 }
 
 func FromPublicPEMWithSalt(publicKeyInPem string, salt, info []byte) (PublicKeyEncryptor, error) {
+	block, _ := pem.Decode([]byte(publicKeyInPem))
+	if block == nil {
+		return nil, errors.New("failed to parse PEM formatted public key")
+	}
+	if block.Type == PEMBlockXWingPublicKey {
+		return NewXWingEncryptor(block.Bytes, salt, info)
+	}
+	if params, ok := hybridParamsFromPublicPEMType(block.Type); ok {
+		return newHybridECMLKEMEncryptor(params, block.Bytes, salt, info)
+	}
+
 	pub, err := getPublicPart(publicKeyInPem)
 	if err != nil {
 		return nil, err

lib/ocrypto/ec_key_pair.go

@@ -22,11 +22,14 @@ type ECCMode uint8
 type KeyType string
 
 const (
-	RSA2048Key KeyType = "rsa:2048"
-	RSA4096Key KeyType = "rsa:4096"
-	EC256Key   KeyType = "ec:secp256r1"
-	EC384Key   KeyType = "ec:secp384r1"
-	EC521Key   KeyType = "ec:secp521r1"
+	RSA2048Key                  KeyType = "rsa:2048"
+	RSA4096Key                  KeyType = "rsa:4096"
+	EC256Key                    KeyType = "ec:secp256r1"
+	EC384Key                    KeyType = "ec:secp384r1"
+	EC521Key                    KeyType = "ec:secp521r1"
+	HybridXWingKey              KeyType = "hpqt:xwing"
+	HybridSecp256r1MLKEM768Key  KeyType = "hpqt:secp256r1-mlkem768"
+	HybridSecp384r1MLKEM1024Key KeyType = "hpqt:secp384r1-mlkem1024"
 )
 
 const (
@@ -64,6 +67,12 @@ func NewKeyPair(kt KeyType) (KeyPair, error) {
 			return nil, err
 		}
 		return NewECKeyPair(mode)
+	case HybridXWingKey:
+		return NewXWingKeyPair()
+	case HybridSecp256r1MLKEM768Key:
+		return NewP256MLKEM768KeyPair()
+	case HybridSecp384r1MLKEM1024Key:
+		return NewP384MLKEM1024KeyPair()
 	default:
 		return nil, fmt.Errorf("unsupported key type: %v", kt)
 	}
@@ -91,6 +100,15 @@ func IsRSAKeyType(kt KeyType) bool {
 	}
 }
 
+func IsHybridKeyType(kt KeyType) bool {
+	switch kt { //nolint:exhaustive // only handle hybrid types
+	case HybridXWingKey, HybridSecp256r1MLKEM768Key, HybridSecp384r1MLKEM1024Key:
+		return true
+	default:
+		return false
+	}
+}
+
 // GetECCurveFromECCMode return elliptic curve from ecc mode
 func GetECCurveFromECCMode(mode ECCMode) (elliptic.Curve, error) {
 	var c elliptic.Curve