linux-kernel - Re: Module signing and post-quantum crypto public key algorithms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aFQDLCvTs8IaAQI_@wunner.de>
Date: Thu, 19 Jun 2025 14:31:40 +0200
From: Lukas Wunner <lukas@...ner.de>
To: David Howells <dhowells@...hat.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>,
	Stephan Mueller <smueller@...onox.de>, Simo Sorce <simo@...hat.com>,
	torvalds@...ux-foundation.org, Paul Moore <paul@...l-moore.com>,
	Ignat Korchagin <ignat@...udflare.com>,
	Clemens Lang <cllang@...hat.com>,
	David Bohannon <dbohanno@...hat.com>,
	Roberto Sassu <roberto.sassu@...wei.com>, keyrings@...r.kernel.org,
	linux-crypto@...r.kernel.org, linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Jonathan Cameron <Jonathan.Cameron@...wei.com>
Subject: Re: Module signing and post-quantum crypto public key algorithms

On Fri, Jun 13, 2025 at 03:54:30PM +0100, David Howells wrote:
> The good news is that Stephan Mueller has an implemementation that includes
> kernel bits that we can use, or, at least, adapt:
> 
> 	https://github.com/smuellerDD/leancrypto/

I assume Herbert will insist that any new algorithm is hardened
against side channel attacks.  Thankfully, Stephan seems to have
put some effort into that:

   "side-channel-resistant: A valgrind-based dynamic side channel
    analysis is applied to find time-variant code paths based on
    secret data."

> However!  Not everyone agrees with this.  An alternative proposal
> would rather get the signature verification code out of the kernel
> entirely.  Simo Sorce's proposal, for example, AIUI, is to compile
> all the hashes we need into the kernel at build time, possibly with
> a hashed hash list to be loaded later to reduce the amount of
> uncompressible code in the kernel.

Module signing isn't the only motivation to add PQC algorithms to
the kernel.  Another is SPDM, a protocol for device authentication,
measurement and secure channel setup.

The DMTF has finally published SPDM 1.4.0 on May 25th and this
revision adds support for PQC algorithms (see list on page 216):

https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.4.0.pdf

An in-kernel implementation is being worked on by Jonathan (+cc) and me:

https://github.com/l1k/linux/commits/doe

We haven't added SPDM 1.4 support yet, but will have to eventually.
So far we only support RSA and ECDSA, because that's the baseline
mandated by the PCIe Base Specification for PCI device authentication.
I expect there'll be an ECN sooner rather than later to extend the
baseline to PQC algorithms.

Thanks,

Lukas