Extension methods for CertificateRevocationListBuilder with post-quantum support.

namespace WvdS.System.Security.Cryptography.X509Certificates;
 
public static class CertificateRevocationListExtensions

Hybrid mode (recommended):

// Load CA certificate
var caCert = new X509Certificate2("ca.pfx", "password");
 
// Create CRL
var builder = new CertificateRevocationListBuilder();
builder.AddEntry(revokedCertificate.SerialNumberBytes.ToArray());
 
// Build CRL with hybrid signature
byte[] crlData = builder.Build(
    caCert,
    crlNumber: BigInteger.One,
    nextUpdate: DateTimeOffset.UtcNow.AddDays(7),
    HashAlgorithmName.SHA256,
    CryptoMode.Hybrid);

byte[] crlData = File.ReadAllBytes("ca.crl");
var caCert = new X509Certificate2("ca.cer");
 
bool isValid = CertificateRevocationListExtensions.VerifySignature(
    crlData,
    caCert,
    CryptoMode.Hybrid);

• RFC 5280¹⁾ - X.509 PKI CRL Profile
• NIST FIPS 204²⁾ - ML-DSA

• RevocationExtensions
• X509ChainExtensions

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional