Re: Module signing and post-quantum crypto public key algorithms

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Fri, 2025-06-13 at 13:33 -0400, Simo Sorce wrote:
> Premise: this problem can't be ignored, even if you think Quantum
> Computers are BS, various government regulations are pushing all
> commercial entities to require PQ signatures, so we have to deal with
> this problem.

I agree it's coming, but there's currently no date for post quantum
requirement in FIPS, which is the main driver for this.

> On Fri, 2025-06-13 at 16:21 +0100, Ignat Korchagin wrote:
> > Hi David,
> > 
> > On Fri, Jun 13, 2025 at 3:54 PM David Howells <dhowells@redhat.com>
> > wrote:
> > > 
> > > Hi,
> > > 
> > > So we need to do something about the impending quantum-related
> > > obsolescence of the RSA signatures that we use for module
> > > signing, kexec, BPF signing, IMA and a bunch of other things.
> > 
> > Is it that impending? At least for now it seems people are more
> > concerned about quantum-safe TLS, so their communications cannot be
> > decrypted later. But breaking signatures of open source modules
> > probably only makes sense when there is an actual capability to
> > break RSA (or ECDSA)
> 
> We do not know when Q-day (or Y2Q if you prefer) will strike, "never"
> is still a possibility.
> 
> But, as a data point, IBM just announced a roadmap for a contraption
> with 200 error corrected logic qubits. That is substantial progress,
> so we cannot assume it will never happen, the risk is too high (it is
> not me saying this, it is the cryptography community consensus).

Current estimates say Shor's algorithm in "reasonable[1]" time requires
around a million qubits to break RSA2048, so we're still several orders
of magnitude off that.  Grover's only requires just over 2,000 (which
is why NIST is worried about that first).

Regards,

James

[1] you can change this by a couple of orders of magnitude depending on
how long you're willing to wait