WIP: Add support for ML-DSA PQC keys#19
WIP: Add support for ML-DSA PQC keys#19stefanberger wants to merge 11 commits intolinux-integrity:next-testingfrom
Conversation
stefanberger
force-pushed
the
mldsa
branch
7 times, most recently
from
1a1ad73 to
b04726b
Compare
stefanberger
force-pushed
the
mldsa
branch
8 times, most recently
from
80459bf to
37929f9
Compare
stefanberger
force-pushed
the
mldsa
branch
4 times, most recently
from
372ffa0 to
22c8a2b
Compare
|
Hi @stefanberger , If I understand the PR correctly, it's actually implementing Pre-Hash ML-DSA. Unfortunately, Currently CNSA 2.0 doesn't allow Pre-Hash ML-DSA,
|
Yes, I am actually aware of exactly this and was wondering whether CNSA 2.0 was either incomplete/incorrect, this had to do something with timing of publication versus timing of HashML-DSA addition to standard, or this means that HashML-DSA is optional and ML-DSA can be used also for hashes. So basically this CNSA 2.0 means "forget about HashML-DSA"?? But then CNSA 2.0 is from NSA and HashML-DSA is from NIST. Left hand / right hand problem?
|
... Also CNSA 2.1 could come out requiring "HashML-DSA" for products created in 202X and later -- if you can maintain backwards compatibility somehow. |
stefanberger
force-pushed
the
mldsa
branch
2 times, most recently
from
a91c745 to
fe98da5
Compare
|
Latest code push now uses pure-mode ML-DSA. |
stefanberger
force-pushed
the
mldsa
branch
2 times, most recently
from
6d327ef to
261c24b
Compare
stefanberger
force-pushed
the
mldsa
branch
6 times, most recently
from
05ae0c3 to
6cbeaf8
Compare
Implement imaevm_create_sigv3 that creates v3 signatures. This function will now also allocate a buffer if the caller did not provide one. Further, it will write the full signature into the signature buffer, including the leading xattr type byte. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for signing IMA signatures with the V3 signing scheme. Introduce a global variable that states which signing scheme to use and for now set it to SIGNATURE_V2. Implement the SIGNATURE_V3 case where necessary for IMA. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for signing EVM signatures with the V3 signing scheme. Implement the SIGNATURE_v3 case where necessary for EVM. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Enable both IMA and EVM file signatures with a new --v3 option that sets the previously introduced global variable that states which signature version to use. Similarly, introduce a --v2 option for users to (already) choose old V2 type of signatures. Update the README with the dump of the evmctl help screen and mention v3 signature format. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add the new --v3 option to the sign_verify_ima test cases. Adjust openssl signature verification to build ima_file_id structure in a file that is then used for signature verification rather than the plain file (as before). Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Convert the code that built the fsverity signature with V3 signing scheme to use the new imaevm_create_sigv3 function. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch separates a previous pending PR with this new stuff here. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the following type of warning: WARNING: Prefer using '"%s...", __func__' to using 'create_sigv3_mldsa', \ this function's name, in a string Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
stefanberger
force-pushed
the
mldsa
branch
5 times, most recently
from
ee5111c to
b190422
Compare
OpenSSL >= v3.5.0 supports signing with ML-DSA-44/65/87. Add support for it to the imaevm_create_sigv3 library function. Since the ML-DSA signatures require a lot more space for the signature now, increase the size of the array where the signatures are stored. The following are the sizes of ML-DSA signatures by key type: - ML-DSA-44: 2420 - ML-DSA-65: 3309 - ML-DSA-87: 4627 Prevent signature V2 from being created with any other key types than 'RSA', 'EC', or 'SM2'. In the functions that created a v2 signature, only RSA, ECDSA, and ECRDSA signatures are created and they can easily work with the old buffer size of less than 1024 bytes. The size availe for extended attributes may be smaller than what is required by the ML-DSA signature size, and therefore may not be possible to store for example ML-DSA-87 signatures (depends on type of filesystem). Nevertheless, extend the MAX_SIGNATURE_SIZE to the required size of ML-DSA-87 and display an error if writing the signature of a size larger than 4k did not work. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
ima-gen-local-ca-mldsa65.sh creates a CA with an ML-DSA-65 key and ima-genkey-mldsa65.sh creates an ML-DSA-65 IMA file signing key along with its certificate. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Create ML-DSA-44 & ML-DSA-65 keys if ML-DSA-44 can be created with the installed version of OpenSSL. Add test cases for signing and verifying with these types of keys. Do not test with ML-DSA-87 keys since the signatures they create may be too large for some filesystems' xattrs. On Btrfs, however, it would be possible to store the large signatures. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2 participants
This series adds support for ML-DSA PQC key support to the library and evmctl and adds test cases for signing and verifying to the sign_verfiy.test. It requires availability of OpenSSL 3.5.