[v3,0/4] Implement ML-DSA-65 for Post-Quantum Cryptographic compliance
mbox series

Message ID 20260519030020.408693-1-hpa@redhat.com
Headers show
Series
  • Implement ML-DSA-65 for Post-Quantum Cryptographic compliance
Related show

Message

Kate Hsuan May 19, 2026, 3 a.m. UTC 
This patchset integrates the ML-DSA-65 [1] signature algorithm to ensure
Post-Quantum Cryptography (PQC) compliance. Following NIST's finalization
of PQC standards [2], ML-DSA has been established as the primary
quantum-resistant signature standard. As quantum computing advances, legacy
algorithms like RSA are becoming increasingly vulnerable and are slated
for replacement by 2035 [3]. By adopting ML-DSA for IPA library signing,
this work secures the long-term integrity of the IPA library and aligns
libcamera with the latest NIST security frameworks.

[1] https://csrc.nist.gov/pubs/fips/204/final
[2] https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria)]
[3] https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf

Changes in v3:
- Add "utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); });"
  and rename the variable name from "ctx_dsa" to "ctx".
- Drop the debug logs from the pub_key.cpp.
- Resolve "[: RSA: unexpected operator" in utils/gen-ipa-priv-key.sh

Changes in v2:
- Change the meson option name from "fips" to "isp-signature-algo".
- Drop the debug print in the pub_key.cpp.
- One line command "openssl pkeyutl" is used to sign the IPA library.

Kate Hsuan (4):
  libcamera: pub_key: Add ML-DSA-65 signature algorithm for PQC
    compliance
  utils: codegen: gen-ipa-pub-key: replace openssl rsa with openssl pkey
  ipa: ipa-sign: Sign IPA according to the signature algorithm of the
    key
  meson: Add ipa-signature-algo option

 meson_options.txt                |  8 ++++++
 src/ipa/ipa-sign.sh              |  2 +-
 src/libcamera/meson.build        |  6 ++++
 src/libcamera/pub_key.cpp        | 48 ++++++++++++++++++++++++++++++--
 src/meson.build                  | 14 ++++++++--
 utils/codegen/gen-ipa-pub-key.py |  2 +-
 utils/gen-ipa-priv-key.sh        | 16 +++++++++--
 7 files changed, 86 insertions(+), 10 deletions(-)