From: Jarkko Sakkinen <jarkko@kernel.org>
To: David Howells <dhowells@redhat.com>
Cc: Lukas Wunner <lukas@wunner.de>,
Ignat Korchagin <ignat@cloudflare.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Eric Biggers <ebiggers@kernel.org>,
Luis Chamberlain <mcgrof@kernel.org>,
Petr Pavlu <petr.pavlu@suse.com>,
Daniel Gomez <da.gomez@kernel.org>,
Sami Tolvanen <samitolvanen@google.com>,
"Jason A . Donenfeld" <Jason@zx2c4.com>,
Ard Biesheuvel <ardb@kernel.org>,
Stephan Mueller <smueller@chronox.de>,
linux-crypto@vger.kernel.org, keyrings@vger.kernel.org,
linux-modules@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v14 4/5] pkcs7, x509: Add ML-DSA support
Date: Sun, 25 Jan 2026 16:42:04 +0200 [thread overview]
Message-ID: <aXYrvMpaQ2rHmFrw@kernel.org> (raw)
In-Reply-To: <20260121223609.1650735-5-dhowells@redhat.com>
On Wed, Jan 21, 2026 at 10:36:06PM +0000, David Howells wrote:
> Add support for ML-DSA keys and signatures to the CMS/PKCS#7 and X.509
> implementations. ML-DSA-44, -65 and -87 are all supported. For X.509
> certificates, the TBSCertificate is required to be signed directly; for CMS,
> direct signing of the data is preferred, though use of SHA512 (and only that)
> as an intermediate hash of the content is permitted with signedAttrs.
>
> Signed-off-by: David Howells <dhowells@redhat.com>
> cc: Lukas Wunner <lukas@wunner.de>
> cc: Ignat Korchagin <ignat@cloudflare.com>
> cc: Stephan Mueller <smueller@chronox.de>
> cc: Eric Biggers <ebiggers@kernel.org>
> cc: Herbert Xu <herbert@gondor.apana.org.au>
> cc: keyrings@vger.kernel.org
> cc: linux-crypto@vger.kernel.org
> ---
> crypto/asymmetric_keys/pkcs7_parser.c | 24 +++++++++++++++++++-
> crypto/asymmetric_keys/public_key.c | 10 +++++++++
> crypto/asymmetric_keys/x509_cert_parser.c | 27 ++++++++++++++++++++++-
> include/linux/oid_registry.h | 5 +++++
> 4 files changed, 64 insertions(+), 2 deletions(-)
>
> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
> index 3cdbab3b9f50..594a8f1d9dfb 100644
> --- a/crypto/asymmetric_keys/pkcs7_parser.c
> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
> @@ -95,11 +95,18 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
> if (sinfo->authattrs) {
> want = true;
> msg->have_authattrs = true;
> + } else if (sinfo->sig->algo_takes_data) {
> + sinfo->sig->hash_algo = "none";
> }
>
> - for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
> + for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next) {
> if (!!sinfo->authattrs != want)
> goto inconsistent;
> +
> + if (!sinfo->authattrs &&
> + sinfo->sig->algo_takes_data)
> + sinfo->sig->hash_algo = "none";
Why don't we have a constant for "none"?
$ git grep "\"none\"" security/
security/apparmor/audit.c: "none",
security/apparmor/lib.c: { "none", DEBUG_NONE },
security/security.c: [LOCKDOWN_NONE] = "none",
$ git grep "\"none\"" crypto
crypto/asymmetric_keys/public_key.c: hash_algo = "none";
crypto/asymmetric_keys/public_key.c: hash_algo = "none";
crypto/testmgr.h: * PKCS#1 RSA test vectors for hash algorithm "none"
IMHO, this a bad practice.
> + }
> return 0;
>
> inconsistent:
> @@ -297,6 +304,21 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
> ctx->sinfo->sig->pkey_algo = "ecrdsa";
> ctx->sinfo->sig->encoding = "raw";
> break;
> + case OID_id_ml_dsa_44:
> + ctx->sinfo->sig->pkey_algo = "mldsa44";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> + case OID_id_ml_dsa_65:
> + ctx->sinfo->sig->pkey_algo = "mldsa65";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> + case OID_id_ml_dsa_87:
> + ctx->sinfo->sig->pkey_algo = "mldsa87";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> default:
> printk("Unsupported pkey algo: %u\n", ctx->last_oid);
> return -ENOPKG;
> diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
> index a46356e0c08b..09a0b83d5d77 100644
> --- a/crypto/asymmetric_keys/public_key.c
> +++ b/crypto/asymmetric_keys/public_key.c
> @@ -142,6 +142,16 @@ software_key_determine_akcipher(const struct public_key *pkey,
> if (strcmp(hash_algo, "streebog256") != 0 &&
> strcmp(hash_algo, "streebog512") != 0)
> return -EINVAL;
> + } else if (strcmp(pkey->pkey_algo, "mldsa44") == 0 ||
> + strcmp(pkey->pkey_algo, "mldsa65") == 0 ||
> + strcmp(pkey->pkey_algo, "mldsa87") == 0) {
> + if (strcmp(encoding, "raw") != 0)
> + return -EINVAL;
> + if (!hash_algo)
> + return -EINVAL;
> + if (strcmp(hash_algo, "none") != 0 &&
> + strcmp(hash_algo, "sha512") != 0)
> + return -EINVAL;
> } else {
> /* Unknown public key algorithm */
> return -ENOPKG;
> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
> index b37cae914987..2fe094f5caf3 100644
> --- a/crypto/asymmetric_keys/x509_cert_parser.c
> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
> @@ -257,6 +257,15 @@ int x509_note_sig_algo(void *context, size_t hdrlen, unsigned char tag,
> case OID_gost2012Signature512:
> ctx->cert->sig->hash_algo = "streebog512";
> goto ecrdsa;
> + case OID_id_ml_dsa_44:
> + ctx->cert->sig->pkey_algo = "mldsa44";
> + goto ml_dsa;
> + case OID_id_ml_dsa_65:
> + ctx->cert->sig->pkey_algo = "mldsa65";
> + goto ml_dsa;
> + case OID_id_ml_dsa_87:
> + ctx->cert->sig->pkey_algo = "mldsa87";
> + goto ml_dsa;
> }
>
> rsa_pkcs1:
> @@ -274,6 +283,12 @@ int x509_note_sig_algo(void *context, size_t hdrlen, unsigned char tag,
> ctx->cert->sig->encoding = "x962";
> ctx->sig_algo = ctx->last_oid;
> return 0;
> +ml_dsa:
> + ctx->cert->sig->algo_takes_data = true;
> + ctx->cert->sig->hash_algo = "none";
> + ctx->cert->sig->encoding = "raw";
> + ctx->sig_algo = ctx->last_oid;
> + return 0;
> }
>
> /*
> @@ -300,7 +315,8 @@ int x509_note_signature(void *context, size_t hdrlen,
>
> if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
> strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 ||
> - strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0) {
> + strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0 ||
> + strncmp(ctx->cert->sig->pkey_algo, "mldsa", 5) == 0) {
> /* Discard the BIT STRING metadata */
> if (vlen < 1 || *(const u8 *)value != 0)
> return -EBADMSG;
> @@ -524,6 +540,15 @@ int x509_extract_key_data(void *context, size_t hdrlen,
> return -ENOPKG;
> }
> break;
> + case OID_id_ml_dsa_44:
> + ctx->cert->pub->pkey_algo = "mldsa44";
> + break;
> + case OID_id_ml_dsa_65:
> + ctx->cert->pub->pkey_algo = "mldsa65";
> + break;
> + case OID_id_ml_dsa_87:
> + ctx->cert->pub->pkey_algo = "mldsa87";
> + break;
> default:
> return -ENOPKG;
> }
> diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h
> index 6de479ebbe5d..ebce402854de 100644
> --- a/include/linux/oid_registry.h
> +++ b/include/linux/oid_registry.h
> @@ -145,6 +145,11 @@ enum OID {
> OID_id_rsassa_pkcs1_v1_5_with_sha3_384, /* 2.16.840.1.101.3.4.3.15 */
> OID_id_rsassa_pkcs1_v1_5_with_sha3_512, /* 2.16.840.1.101.3.4.3.16 */
>
> + /* NIST FIPS-204 ML-DSA */
> + OID_id_ml_dsa_44, /* 2.16.840.1.101.3.4.3.17 */
> + OID_id_ml_dsa_65, /* 2.16.840.1.101.3.4.3.18 */
> + OID_id_ml_dsa_87, /* 2.16.840.1.101.3.4.3.19 */
> +
> OID__NR
> };
>
>
BR, Jarkko
next prev parent reply other threads:[~2026-01-25 14:42 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-21 22:36 [PATCH v14 0/5] x509, pkcs7, crypto: Add ML-DSA and RSASSA-PSS signing David Howells
2026-01-21 22:36 ` [PATCH v14 1/5] crypto: Add ML-DSA crypto_sig support David Howells
2026-01-21 22:36 ` [PATCH v14 2/5] x509: Separately calculate sha256 for blacklist David Howells
2026-01-25 14:34 ` Jarkko Sakkinen
2026-01-21 22:36 ` [PATCH v14 3/5] pkcs7: Allow the signing algo to do whatever digestion it wants itself David Howells
2026-01-25 14:38 ` Jarkko Sakkinen
2026-01-26 11:11 ` David Howells
2026-01-21 22:36 ` [PATCH v14 4/5] pkcs7, x509: Add ML-DSA support David Howells
2026-01-25 14:42 ` Jarkko Sakkinen [this message]
2026-01-26 11:25 ` David Howells
2026-01-26 13:56 ` James Bottomley
2026-01-26 12:02 ` Christophe Leroy (CS GROUP)
2026-01-21 22:36 ` [PATCH v14 5/5] modsign: Enable ML-DSA module signing David Howells
2026-01-25 14:44 ` Jarkko Sakkinen
2026-01-23 11:13 ` [PATCH v14 0/5] x509, pkcs7, crypto: Add ML-DSA and RSASSA-PSS signing David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXYrvMpaQ2rHmFrw@kernel.org \
--to=jarkko@kernel.org \
--cc=Jason@zx2c4.com \
--cc=ardb@kernel.org \
--cc=da.gomez@kernel.org \
--cc=dhowells@redhat.com \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=ignat@cloudflare.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-modules@vger.kernel.org \
--cc=lukas@wunner.de \
--cc=mcgrof@kernel.org \
--cc=petr.pavlu@suse.com \
--cc=samitolvanen@google.com \
--cc=smueller@chronox.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox