[{"id":39077,"web_url":"https://patchwork.libcamera.org/comment/39077/","msgid":"<20260615144043.GB2849765@killaraus.ideasonboard.com>","date":"2026-06-15T14:40:43","subject":"Re: [PATCH v3 1/4] libcamera: pub_key: Add ML-DSA-65 signature\n\talgorithm for PQC compliance","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Kate,\n\nThank you for the patch.\n\nOn Tue, May 19, 2026 at 11:00:17AM +0800, Kate Hsuan wrote:\n> As quantum computing advances, traditional signature algorithms are\n> becoming vulnerable. To ensure long-term data security, this change\n> implements ML-DSA-65, the primary Post-Quantum Cryptography (PQC)\n> standard finalized by NIST. This addition prepares for the transition\n> away from RSA, which is slated for deprecation by 2035.\n\nNot that this is a reason not to integrate ML-DSA support, but this\nseries shows in my opinion how blindly designing and applying\nregulations makes no sense. Quantum computing attacks against the\nlibcamera IPA module signing is not a security concern at all.\n\n> Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria)\n> Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf\n> Signed-off-by: Kate Hsuan \n> \n> ../src/libcamera/pub_key.cpp fix\n> ---\n> src/libcamera/pub_key.cpp | 48 ++++++++++++++++++++++++++++++++++++---\n> 1 file changed, 45 insertions(+), 3 deletions(-)\n> \n> diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp\n> index f1d73a5c..a169cf7a 100644\n> --- a/src/libcamera/pub_key.cpp\n> +++ b/src/libcamera/pub_key.cpp\n> @@ -14,8 +14,13 @@\n> #include \n> #elif HAVE_GNUTLS\n> #include \n> +#include \n> #endif\n> \n> +#include \"libcamera/internal/pub_key.h\"\n> +#include \n> +#include \n\ncheckstyle.py reports a warning.\n\n> +\n> /**\n> * \\file pub_key.h\n> * \\brief Public key signature verification\n> @@ -28,12 +33,18 @@ namespace libcamera {\n> * \\brief Public key wrapper for signature verification\n> *\n> * The PubKey class wraps a public key and implements signature verification. It\n> - * only supports RSA keys and the RSA-SHA256 signature algorithm.\n> + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys\n> + * as specified in NIST FIPS 204. The signature algorithm is determined in\n\ns/in$/at/\n\n> + * compile time.\n> */\n> \n> /**\n> * \\brief Construct a PubKey from key data\n> * \\param[in] key Key data encoded in DER format\n> + *\n> + * The signature algorithm is determined in the compile\n\nIncomplete sentence ?\n\nWe could drop this paragraph as it's already mentioned above in the\nclass documentation.\n\n> + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65\n> + * (verified as ML-DSA-65 according to FIPS 204).\n> */\n> PubKey::PubKey([[maybe_unused]] Span key)\n> \t: valid_(false)\n> @@ -83,7 +94,8 @@ PubKey::~PubKey()\n> * \\param[in] sig The signature\n> *\n> * Verify that the signature \\a sig matches the signed \\a data for the public\n> - * key. The signture algorithm is hardcoded to RSA-SHA256.\n> + * key. The signature algorithm is determined in compile time. RSA keys use\n> + * RSA-SHA256, while ML-DSA keys use ML-DSA-65 mentioned in FIPS 204.\n\nHere too we could drop the RSA-SHA256 mention.\n\n> *\n> * \\return True if the signature is valid, false otherwise\n> */\n> @@ -94,6 +106,25 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> \t\treturn false;\n> \n> #if HAVE_CRYPTO\n> +\n> +#if WITH_PQC\n\nI would prefer naming this HAVE_CRYPTO_ML_DSA_65. It's more explicit and\nmatches the HAVE_* prefix of other config macros.\n\n> +\t/* ML-DSA */\n> +\tEVP_MD_CTX *ctx = EVP_MD_CTX_new();\n> +\tif (!ctx)\n> +\t\treturn false;\n> +\n> +\tutils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); });\n> +\n> +\tif (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr,\n> +\t\t\t\t pubkey_) <= 0) {\n\nStray curly bracket.\n\n> +\t\treturn false;\n> +\n> +\tint ret = EVP_DigestVerify(ctx, sig.data(), sig.size(),\n> +\t\t\t\t data.data(), data.size());\n\nAccording to the man pages, those functions support RSA with SHA-256. I\ntested using them with RSA-SHA256 and they seem to work. I think you can\ndrop the existing RSA-SHA-256 code and replace it with\nEVP_DigestVerify() unconditionally.\n\n> +\treturn ret == 1;\n> +#else\n> +\t/* RSA with SHA-256 */\n> +\n> \t/*\n> \t * Create and initialize a public key algorithm context for signature\n> \t * verification.\n> @@ -117,7 +148,10 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> \tint ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest,\n> \t\t\t\t SHA256_DIGEST_LENGTH);\n> \tEVP_PKEY_CTX_free(ctx);\n> +\n> \treturn ret == 1;\n> +#endif\n> +\n> #elif HAVE_GNUTLS\n> \tconst gnutls_datum_t gnuTlsData{\n> \t\tconst_cast(data.data()),\n> @@ -129,9 +163,17 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> \t\tstatic_cast(sig.size())\n> \t};\n> \n> -\tint ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0,\n> +#if WITH_PQC\n> +\tint ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_MLDSA65, 0,\n> \t\t\t\t\t &gnuTlsData, &gnuTlsSig);\n> +\n> \treturn ret >= 0;\n> +#else\n> +\tint ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256,\n> +\t\t\t\t\t 0, &gnuTlsData, &gnuTlsSig);\n> +\n> +\treturn ret >= 0;\n> +#endif\n\nLet's minimize the conditional compilation coverage:\n\n\tconstexpr gnutls_sign_algorithm_t algo =\n#if WITH_PQC\n\t\tGNUTLS_SIGN_MLDSA65;\n#else\n\t\tGNUTLS_SIGN_RSA_SHA256;\n#endif\n\n\tint ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, &gnuTlsData,\n\t\t\t\t\t &gnuTlsSig);\n\n> #else\n> \treturn false;\n> #endif","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id E686AC328C\n\tfor ;\n\tMon, 15 Jun 2026 14:40:47 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 10D3E623E6;\n\tMon, 15 Jun 2026 16:40:47 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8B6DC623E1\n\tfor ;\n\tMon, 15 Jun 2026 16:40:45 +0200 (CEST)","from killaraus.ideasonboard.com\n\t(2001-14ba-70f3-e800--a06.rev.dnainternet.fi\n\t[IPv6:2001:14ba:70f3:e800::a06])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 65095227;\n\tMon, 15 Jun 2026 16:40:12 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"LmnL00qa\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1781534412;\n\tbh=8o4njtZ6woReiq7ERgzE27Q7RGMtsddlRE2PgsINUyg=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=LmnL00qaO5IRFumE+5zHkyzDeXnp7TV+0qttHeg1tJyfbdj2KYyCnzr71cG5iFReb\n\tiJzGeGYRFyO4qV7IHS4qJ8A3emHc2eg2g7h+E+AEibo4NhSvT6iingLkNk+nYbWeV+\n\t1BZ3/RabbnF436Gvc/rEE8foiCWY2SsNzr/2dkYo=","Date":"Mon, 15 Jun 2026 17:40:43 +0300","From":"Laurent Pinchart ","To":"Kate Hsuan ","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= , Kieran Bingham\n\t","Subject":"Re: [PATCH v3 1/4] libcamera: pub_key: Add ML-DSA-65 signature\n\talgorithm for PQC compliance","Message-ID":"<20260615144043.GB2849765@killaraus.ideasonboard.com>","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t<20260519030020.408693-2-hpa@redhat.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20260519030020.408693-2-hpa@redhat.com>","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39170,"web_url":"https://patchwork.libcamera.org/comment/39170/","msgid":"","date":"2026-06-18T07:13:10","subject":"Re: [PATCH v3 1/4] libcamera: pub_key: Add ML-DSA-65 signature\n\talgorithm for PQC compliance","submitter":{"id":105,"url":"https://patchwork.libcamera.org/api/people/105/","name":"Kate Hsuan","email":"hpa@redhat.com"},"content":"Hi Laurent,\n\nThank you for reviewing this work.\n\nOn Mon, Jun 15, 2026 at 10:40 PM Laurent Pinchart\n wrote:\n>\n> Hi Kate,\n>\n> Thank you for the patch.\n>\n> On Tue, May 19, 2026 at 11:00:17AM +0800, Kate Hsuan wrote:\n> > As quantum computing advances, traditional signature algorithms are\n> > becoming vulnerable. To ensure long-term data security, this change\n> > implements ML-DSA-65, the primary Post-Quantum Cryptography (PQC)\n> > standard finalized by NIST. This addition prepares for the transition\n> > away from RSA, which is slated for deprecation by 2035.\n>\n> Not that this is a reason not to integrate ML-DSA support, but this\n> series shows in my opinion how blindly designing and applying\n> regulations makes no sense. Quantum computing attacks against the\n> libcamera IPA module signing is not a security concern at all.\n\nI'll change this and focus on RSA deprecation, such as\n1. The RSA is slated for deprecation by 2035. The IPA signature\nalgorithm should be migrated from RSA to a PQC-specified algorithm.\n2. Primary Post-Quantum Cryptography (PQC) standard finalized by NIST\nand the ML-DSA is used for signature.\n3. ML-DSA includes ML-DSA-44, ML-DSA-65, and ML-DSA-87 covers\ndifferent level of data integraty protection. ML-DSA-65 is a balanced\noption for general purposes, so it is selected to sign the IPA.\n\n\n>\n> > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria)\n> > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf\n> > Signed-off-by: Kate Hsuan \n> >\n> > ../src/libcamera/pub_key.cpp fix\n> > ---\n> > src/libcamera/pub_key.cpp | 48 ++++++++++++++++++++++++++++++++++++---\n> > 1 file changed, 45 insertions(+), 3 deletions(-)\n> >\n> > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp\n> > index f1d73a5c..a169cf7a 100644\n> > --- a/src/libcamera/pub_key.cpp\n> > +++ b/src/libcamera/pub_key.cpp\n> > @@ -14,8 +14,13 @@\n> > #include \n> > #elif HAVE_GNUTLS\n> > #include \n> > +#include \n> > #endif\n> >\n> > +#include \"libcamera/internal/pub_key.h\"\n> > +#include \n> > +#include \n>\n> checkstyle.py reports a warning.\nI'll check the style again with checkstyle.py.\n\n>\n> > +\n> > /**\n> > * \\file pub_key.h\n> > * \\brief Public key signature verification\n> > @@ -28,12 +33,18 @@ namespace libcamera {\n> > * \\brief Public key wrapper for signature verification\n> > *\n> > * The PubKey class wraps a public key and implements signature verification. It\n> > - * only supports RSA keys and the RSA-SHA256 signature algorithm.\n> > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys\n> > + * as specified in NIST FIPS 204. The signature algorithm is determined in\n>\n> s/in$/at/\n The signature algorithm is determined at\n\n>\n> > + * compile time.\n> > */\n> >\n> > /**\n> > * \\brief Construct a PubKey from key data\n> > * \\param[in] key Key data encoded in DER format\n> > + *\n> > + * The signature algorithm is determined in the compile\n>\n> Incomplete sentence ?\nYes :(\n\n>\n> We could drop this paragraph as it's already mentioned above in the\n> class documentation.\nOkay.\n\n>\n> > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65\n> > + * (verified as ML-DSA-65 according to FIPS 204).\n> > */\n> > PubKey::PubKey([[maybe_unused]] Span key)\n> > : valid_(false)\n> > @@ -83,7 +94,8 @@ PubKey::~PubKey()\n> > * \\param[in] sig The signature\n> > *\n> > * Verify that the signature \\a sig matches the signed \\a data for the public\n> > - * key. The signture algorithm is hardcoded to RSA-SHA256.\n> > + * key. The signature algorithm is determined in compile time. RSA keys use\n> > + * RSA-SHA256, while ML-DSA keys use ML-DSA-65 mentioned in FIPS 204.\n>\n> Here too we could drop the RSA-SHA256 mention.\nOkay.\n\n>\n> > *\n> > * \\return True if the signature is valid, false otherwise\n> > */\n> > @@ -94,6 +106,25 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> > return false;\n> >\n> > #if HAVE_CRYPTO\n> > +\n> > +#if WITH_PQC\n>\n> I would prefer naming this HAVE_CRYPTO_ML_DSA_65. It's more explicit and\n> matches the HAVE_* prefix of other config macros.\nDiscussed in the patch [4/4].\n\n>\n> > + /* ML-DSA */\n> > + EVP_MD_CTX *ctx = EVP_MD_CTX_new();\n> > + if (!ctx)\n> > + return false;\n> > +\n> > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); });\n> > +\n> > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr,\n> > + pubkey_) <= 0) {\n>\n> Stray curly bracket.\nI'll remove it.\n\n>\n> > + return false;\n> > +\n> > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(),\n> > + data.data(), data.size());\n>\n> According to the man pages, those functions support RSA with SHA-256. I\n> tested using them with RSA-SHA256 and they seem to work. I think you can\n> drop the existing RSA-SHA-256 code and replace it with\n> EVP_DigestVerify() unconditionally.\nOkay\n\n>\n> > + return ret == 1;\n> > +#else\n> > + /* RSA with SHA-256 */\n> > +\n> > /*\n> > * Create and initialize a public key algorithm context for signature\n> > * verification.\n> > @@ -117,7 +148,10 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> > int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest,\n> > SHA256_DIGEST_LENGTH);\n> > EVP_PKEY_CTX_free(ctx);\n> > +\n> > return ret == 1;\n> > +#endif\n> > +\n> > #elif HAVE_GNUTLS\n> > const gnutls_datum_t gnuTlsData{\n> > const_cast(data.data()),\n> > @@ -129,9 +163,17 @@ bool PubKey::verify([[maybe_unused]] Span data,\n> > static_cast(sig.size())\n> > };\n> >\n> > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0,\n> > +#if WITH_PQC\n> > + int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_MLDSA65, 0,\n> > &gnuTlsData, &gnuTlsSig);\n> > +\n> > return ret >= 0;\n> > +#else\n> > + int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256,\n> > + 0, &gnuTlsData, &gnuTlsSig);\n> > +\n> > + return ret >= 0;\n> > +#endif\n>\n> Let's minimize the conditional compilation coverage:\nDiscussed in the patch [4/4].\n\n>\n> constexpr gnutls_sign_algorithm_t algo =\n> #if WITH_PQC\n> GNUTLS_SIGN_MLDSA65;\n> #else\n> GNUTLS_SIGN_RSA_SHA256;\n> #endif\n>\n> int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, &gnuTlsData,\n> &gnuTlsSig);\n>\n> > #else\n> > return false;\n> > #endif\n>\n> --\n> Regards,\n>\n> Laurent Pinchart\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id CAB38C3261\n\tfor ;\n\tThu, 18 Jun 2026 07:13:29 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id E4D156297E;\n\tThu, 18 Jun 2026 09:13:28 +0200 (CEST)","from us-smtp-delivery-124.mimecast.com\n\t(us-smtp-delivery-124.mimecast.com [170.10.133.124])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D1B0861EFB\n\tfor ;\n\tThu, 18 Jun 2026 09:13:26 +0200 (CEST)","from mail-ot1-f70.google.com (mail-ot1-f70.google.com\n\t[209.85.210.70]) by relay.mimecast.com with ESMTP with STARTTLS\n\t(version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n\tus-mta-588-jb5UPXPTNiK8bz2eRvNLPw-1; Thu, 18 Jun 2026 03:13:23 -0400","by mail-ot1-f70.google.com with SMTP id\n\t46e09a7af769-7e6cea6ada5so1444699a34.1\n\tfor ;\n\tThu, 18 Jun 2026 00:13:23 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=redhat.com header.i=@redhat.com\n\theader.b=\"XCxwnM7n\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n\ts=mimecast20190719; t=1781766805;\n\th=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n\tto:to:cc:cc:mime-version:mime-version:content-type:content-type:\n\tcontent-transfer-encoding:content-transfer-encoding:\n\tin-reply-to:in-reply-to:references:references;\n\tbh=bdHGwAMM0YRgYZzoKtVtfECxQ8EkYF8CMRfZPdRjpPs=;\n\tb=XCxwnM7nsI1dGU7/qaktAkF014SXfJUzwFWsRdozks1xqva/OaYeAciHRukshyH/IKeCR3\n\tXlELIZ3XklHr7731MqvlBtUybn2Bd9q+AGKMmB1V9BWqrTjjz6tVDuXiYn9NIhRHEXBTrf\n\tdqsVikUfXs7BVrp8SmnAiN/OuzC0tbw=","X-MC-Unique":"jb5UPXPTNiK8bz2eRvNLPw-1","X-Mimecast-MFC-AGG-ID":"jb5UPXPTNiK8bz2eRvNLPw_1781766803","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20251104; t=1781766803; x=1782371603;\n\th=content-transfer-encoding:cc:to:subject:message-id:date:from\n\t:in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n\t:to:cc:subject:date:message-id:reply-to;\n\tbh=bdHGwAMM0YRgYZzoKtVtfECxQ8EkYF8CMRfZPdRjpPs=;\n\tb=n/DAIBsnAs+3H5UJ8RPxmyDq2B8vzp006tfz7in54bwS5fAX1QZNOYzFfYSTawz42c\n\t9iDV5rEBkhdI3PiksKHJ1GqzVk1iXNDFmMB9IRko4lcox9YQf7UPkTztWykf9xTVMC5R\n\tzsLfojYCb5LOVmq5K6Es4yHMiuThIud01m8gsbLCVYwyC/MtyKvT5zXBW7DOAJdC4U5R\n\tNM9dhIHO49Tw0XZnVnz7f8rKQsCzznFZX61rYR1Y4P9Q64ZzqDN7dynFfN0shUWFJWTi\n\t3Vodgcqik+w5KyvlMWZruv90n5HIuM+ruRiP7UEMcHQWoXAutdtBHZM0vt0aT5IRFcC6\n\t/PNQ==","X-Gm-Message-State":"AOJu0Yy5RegFhjPBDtgQvsKWZtkZ3nRC5ASV6F34bHdaUHVxHh6QEm14\n\tRkbJV1NRep1qqUl9ASpwGlBdWntPT82WnUSgVDe8h7medgyLJ0kKcPYwvRe3YJ/LBxX220/vnKI\n\txrWyv/aZEO2aG0u/Wwkmcf9WLZUaqsl2IkdU7a3lrteLAtVOHAjltN2KNvuXAlWp+7G6vndpWrr\n\tdBYzdfo6bRKX5wGNR2nJNfvcRfbIOw4QWx6bFwhQuafllm0Mpb19kue9UdeaJP","X-Gm-Gg":"Acq92OHeYOvIiy0o+EpZmYIig7zJRK2qCKIdczf2s/XL/WVWP9hv70Hh2Bf43Qg7b5Y\n\t9Nv6/pmGSqsD69fmh8+rVjcrztr7XTbX48FjGJ3SWYiShUbPlJeDzb3ev5d/BAUAt3Y/y2D+8DJ\n\thr0SI60HeiwEDzUF80bLepQSifyvACpsvNTOSQbnjI5DBasjC+PmDBKgDqvZrDuCFdlKE=","X-Received":["by 2002:a05:6820:1c98:b0:69e:3e2a:a83d with SMTP id\n\t006d021491bc7-6a0b60c052emr6025604eaf.32.1781766803041; \n\tThu, 18 Jun 2026 00:13:23 -0700 (PDT)","by 2002:a05:6820:1c98:b0:69e:3e2a:a83d with SMTP id\n\t006d021491bc7-6a0b60c052emr6025588eaf.32.1781766802533;\n\tThu, 18 Jun 2026 00:13:22 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t<20260519030020.408693-2-hpa@redhat.com>\n\t<20260615144043.GB2849765@killaraus.ideasonboard.com>","In-Reply-To":"<20260615144043.GB2849765@killaraus.ideasonboard.com>","From":"Kate Hsuan ","Date":"Thu, 18 Jun 2026 15:13:10 +0800","X-Gm-Features":"AVVi8CcbPmaQyMo_ppbHhykgjLI1_R5elG0fNb6Cac614w0ABCEgAj-R0p5u6So","Message-ID":"","Subject":"Re: [PATCH v3 1/4] libcamera: pub_key: Add ML-DSA-65 signature\n\talgorithm for PQC compliance","To":"Laurent Pinchart ","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= , Kieran Bingham\n\t","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"JOH4xa_l6-XVptb_Ua9e6V8MoElF4jMCdq3MQcJdKJg_1781766803","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}}]