ML-KEM: EncryptedPrivateKeyInfo exports

[vcsjones]

This pull request adds PKCS#8 EncryptedPrivateKeyInfo exports.

Contributes to #113508

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[Copilot]

Pull Request Overview

This pull request adds new APIs to export ML-KEM keys in the PKCS#8 EncryptedPrivateKeyInfo format, along with comprehensive tests to validate the new functionality.

• Introduces overloads for ExportEncryptedPkcs8PrivateKey and TryExportEncryptedPkcs8PrivateKey accepting both char- and byte-based passwords.
• Adds validation tests for proper handling of PBE parameters, disposal states, and buffer size scenarios.
• Extends test coverage in MLKemContractTests and MLKemBaseTests to verify roundtrip key export and import behaviors.

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs	Added API declarations for exporting encrypted PKCS#8 private keys.
src/libraries/Common/tests/System/Security/Cryptography/MLKemContractTests.cs	Added tests for disposal and parameter validation regarding encrypted PKCS#8 export.
src/libraries/Common/tests/System/Security/Cryptography/MLKemBaseTests.cs	Extended tests to cover roundtrip and failure cases for encrypted PKCS#8 exports.
src/libraries/Common/src/System/Security/Cryptography/MLKem.cs	Implemented encryption export functionality and helper method for buffer sizing and ASN.1 encoding.

Files not reviewed (1)

• src/libraries/Microsoft.Bcl.Cryptography/tests/Microsoft.Bcl.Cryptography.Tests.csproj: Language not supported

Comments suppressed due to low confidence (1)

src/libraries/Common/tests/System/Security/Cryptography/MLKemBaseTests.cs:593

• [nitpick] Consider separating the tests for TryExportPkcs8PrivateKey and ExportPkcs8PrivateKey into distinct test cases to provide clearer isolation of failures and improve maintainability.

callback(pkcs8); callback(kem.ExportPkcs8PrivateKey());

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.