linux-kernel - Re: Module signing and post-quantum crypto public key algorithms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3081793dc1d846dccef07984520fc544f709ca84.camel@HansenPartnership.com>
Date: Fri, 13 Jun 2025 13:50:22 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Simo Sorce <simo@...hat.com>, Ignat Korchagin <ignat@...udflare.com>, 
	David Howells <dhowells@...hat.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>, Stephan Mueller
	 <smueller@...onox.de>, torvalds@...ux-foundation.org, Paul Moore
	 <paul@...l-moore.com>, Lukas Wunner <lukas@...ner.de>, Clemens Lang
	 <cllang@...hat.com>, David Bohannon <dbohanno@...hat.com>, Roberto Sassu
	 <roberto.sassu@...wei.com>, keyrings@...r.kernel.org, 
	linux-crypto@...r.kernel.org, linux-security-module@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: Module signing and post-quantum crypto public key algorithms

On Fri, 2025-06-13 at 13:33 -0400, Simo Sorce wrote:
> Premise: this problem can't be ignored, even if you think Quantum
> Computers are BS, various government regulations are pushing all
> commercial entities to require PQ signatures, so we have to deal with
> this problem.

I agree it's coming, but there's currently no date for post quantum
requirement in FIPS, which is the main driver for this.

> On Fri, 2025-06-13 at 16:21 +0100, Ignat Korchagin wrote:
> > Hi David,
> > 
> > On Fri, Jun 13, 2025 at 3:54 PM David Howells <dhowells@...hat.com>
> > wrote:
> > > 
> > > Hi,
> > > 
> > > So we need to do something about the impending quantum-related
> > > obsolescence of the RSA signatures that we use for module
> > > signing, kexec, BPF signing, IMA and a bunch of other things.
> > 
> > Is it that impending? At least for now it seems people are more
> > concerned about quantum-safe TLS, so their communications cannot be
> > decrypted later. But breaking signatures of open source modules
> > probably only makes sense when there is an actual capability to
> > break RSA (or ECDSA)
> 
> We do not know when Q-day (or Y2Q if you prefer) will strike, "never"
> is still a possibility.
> 
> But, as a data point, IBM just announced a roadmap for a contraption
> with 200 error corrected logic qubits. That is substantial progress,
> so we cannot assume it will never happen, the risk is too high (it is
> not me saying this, it is the cryptography community consensus).

Current estimates say Shor's algorithm in "reasonable[1]" time requires
around a million qubits to break RSA2048, so we're still several orders
of magnitude off that.  Grover's only requires just over 2,000 (which
is why NIST is worried about that first).

Regards,

James

[1] you can change this by a couple of orders of magnitude depending on
how long you're willing to wait