Re: IMA and PQC

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Feb 25, 2026 at 09:25:43AM -0500, Stefan Berger wrote:
> To avoid duplicate work: Is either one of you planning on writing patches
> for IMA to use ML-DSA and convert the current ML-DSA to also support HashML?
> I had done the work on this before and could dig out the patches again...

IMA already had to add its own digest prefixing support, since it was
needed to disambiguate between full-file digests and fsverity digests.
See 'struct ima_file_id'.  Thus the message signed is at most 66 bytes.

With that being the case, HashML-DSA isn't necessary.  It's not even
possible to use here, since there are no OIDs assigned for the fsverity
digests, so it cannot replace the ima_file_id.

I'll also note that HashML-DSA is controversial (e.g. see
https://keymaterial.net/2024/11/05/hashml-dsa-considered-harmful/),
since it was added to the ML-DSA specification at a late stage without
sufficient review, and what it does can be achieved in better ways.
Which is exactly what we are seeing here, since again, IMA needs to do
the digest calculation and prefixing itself anyway.

- Eric