Re: Module signing and post-quantum crypto public key algorithms

[Lukas Wunner <lukas@wunner.de>]

On Fri, Jun 13, 2025 at 03:54:30PM +0100, David Howells wrote:
> The good news is that Stephan Mueller has an implemementation that includes
> kernel bits that we can use, or, at least, adapt:
> 
> 	https://github.com/smuellerDD/leancrypto/

I assume Herbert will insist that any new algorithm is hardened
against side channel attacks.  Thankfully, Stephan seems to have
put some effort into that:

   "side-channel-resistant: A valgrind-based dynamic side channel
    analysis is applied to find time-variant code paths based on
    secret data."

> However!  Not everyone agrees with this.  An alternative proposal
> would rather get the signature verification code out of the kernel
> entirely.  Simo Sorce's proposal, for example, AIUI, is to compile
> all the hashes we need into the kernel at build time, possibly with
> a hashed hash list to be loaded later to reduce the amount of
> uncompressible code in the kernel.

Module signing isn't the only motivation to add PQC algorithms to
the kernel.  Another is SPDM, a protocol for device authentication,
measurement and secure channel setup.

The DMTF has finally published SPDM 1.4.0 on May 25th and this
revision adds support for PQC algorithms (see list on page 216):

https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.4.0.pdf

An in-kernel implementation is being worked on by Jonathan (+cc) and me:

https://github.com/l1k/linux/commits/doe

We haven't added SPDM 1.4 support yet, but will have to eventually.
So far we only support RSA and ECDSA, because that's the baseline
mandated by the PCIe Base Specification for PCI device authentication.
I expect there'll be an ECN sooner rather than later to extend the
baseline to PQC algorithms.

Thanks,

Lukas