| Message ID | 20260701040721.145659-2-hpa@redhat.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series |
|
| Related | show |
Hi 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > With RSA slated for deprecation by 2035, the IPA signature algorithm must > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > varying levels of data integrity protection. ML-DSA-65 has been selected > to sign the IPA due to its balanced performance for general-purpose > applications. > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > Signed-off-by: Kate Hsuan <hpa@redhat.com> > --- > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > 1 file changed, 25 insertions(+), 20 deletions(-) > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > index f1d73a5c..539a4e6d 100644 > --- a/src/libcamera/pub_key.cpp > +++ b/src/libcamera/pub_key.cpp > @@ -14,8 +14,13 @@ > #include <openssl/x509.h> > #elif HAVE_GNUTLS > #include <gnutls/abstract.h> > +#include <gnutls/gnutls.h> > #endif > > +#include <libcamera/base/utils.h> > + > +#include "libcamera/internal/pub_key.h" > + > /** > * \file pub_key.h > * \brief Public key signature verification > @@ -28,12 +33,17 @@ namespace libcamera { > * \brief Public key wrapper for signature verification > * > * The PubKey class wraps a public key and implements signature verification. It > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > + * as specified in NIST FIPS 204. The signature algorithm is determined at > + * compile time. > */ > > /** > * \brief Construct a PubKey from key data > * \param[in] key Key data encoded in DER format > + * > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > + * (verified as ML-DSA-65 according to FIPS 204). > */ > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > : valid_(false) > @@ -83,7 +93,7 @@ PubKey::~PubKey() > * \param[in] sig The signature > * > * Verify that the signature \a sig matches the signed \a data for the public > - * key. The signture algorithm is hardcoded to RSA-SHA256. > + * key. > * > * \return True if the signature is valid, false otherwise > */ > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > return false; > > #if HAVE_CRYPTO Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked with libcrypto is because it will automatically determine the correct algorithm (from the public key or such?)? And I imagine that is not an option with gnutls? > - /* > - * Create and initialize a public key algorithm context for signature > - * verification. > - */ > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > if (!ctx) > return false; > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > - EVP_PKEY_CTX_free(ctx); > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > + > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > + pubkey_) <= 0) > return false; > - } > > - /* Calculate the SHA256 digest of the data. */ > - uint8_t digest[SHA256_DIGEST_LENGTH]; > - SHA256(data.data(), data.size(), digest); > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > + data.data(), data.size()); > > - /* Decrypt the signature and verify it matches the digest. */ > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > - SHA256_DIGEST_LENGTH); > - EVP_PKEY_CTX_free(ctx); > return ret == 1; > + > #elif HAVE_GNUTLS > const gnutls_datum_t gnuTlsData{ > const_cast<unsigned char *>(data.data()), > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > static_cast<unsigned int>(sig.size()) > }; > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > + constexpr gnutls_sign_algorithm_t algo = > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; Let's doy constexpr gnutls_sign_algorithm_t algo = [] { constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; if constexpr (name == "ml-dsa-65") return GNUTLS_SIGN_MLDSA65; if constexpr (name == "rsa-sha256") return GNUTLS_SIGN_RSA_SHA256; } (); This way it should be a compilation error if you use an unexpected name for some reason. > + > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > &gnuTlsData, &gnuTlsSig); > + > return ret >= 0; > #else > return false;
On Wed, Jul 01, 2026 at 10:56:09AM +0200, Barnabás Pőcze wrote: > Hi > > 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > > With RSA slated for deprecation by 2035, the IPA signature algorithm must > > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > > varying levels of data integrity protection. ML-DSA-65 has been selected > > to sign the IPA due to its balanced performance for general-purpose > > applications. > > > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > > Signed-off-by: Kate Hsuan <hpa@redhat.com> > > --- > > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > > 1 file changed, 25 insertions(+), 20 deletions(-) > > > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > > index f1d73a5c..539a4e6d 100644 > > --- a/src/libcamera/pub_key.cpp > > +++ b/src/libcamera/pub_key.cpp > > @@ -14,8 +14,13 @@ > > #include <openssl/x509.h> > > #elif HAVE_GNUTLS > > #include <gnutls/abstract.h> > > +#include <gnutls/gnutls.h> > > #endif > > > > +#include <libcamera/base/utils.h> > > + > > +#include "libcamera/internal/pub_key.h" > > + > > /** > > * \file pub_key.h > > * \brief Public key signature verification > > @@ -28,12 +33,17 @@ namespace libcamera { > > * \brief Public key wrapper for signature verification > > * > > * The PubKey class wraps a public key and implements signature verification. It > > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > > + * as specified in NIST FIPS 204. The signature algorithm is determined at > > + * compile time. > > */ > > > > /** > > * \brief Construct a PubKey from key data > > * \param[in] key Key data encoded in DER format > > + * > > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > > + * (verified as ML-DSA-65 according to FIPS 204). > > */ > > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > > : valid_(false) > > @@ -83,7 +93,7 @@ PubKey::~PubKey() > > * \param[in] sig The signature > > * > > * Verify that the signature \a sig matches the signed \a data for the public > > - * key. The signture algorithm is hardcoded to RSA-SHA256. > > + * key. > > * > > * \return True if the signature is valid, false otherwise > > */ > > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > return false; > > > > #if HAVE_CRYPTO > > Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked > with libcrypto is because it will automatically determine the correct algorithm > (from the public key or such?)? And I imagine that is not an option with gnutls? The following seems to work for gnutls (error handling left as an exercise for the reader): gnutls_digest_algorithm_t hash; gnutls_pubkey_get_preferred_hash_algorithm(pubkey_, &hash, nullptr); gnutls_pk_algorithm_t pkeyAlgo = static_cast<gnutls_pk_algorithm_t>(gnutls_pubkey_get_pk_algorithm(pubkey_, nullptr)); gnutls_sign_algorithm_t algo = gnutls_pk_to_sign(pkeyAlgo, hash); It may be a bit complex and a bit fragile though. > > - /* > > - * Create and initialize a public key algorithm context for signature > > - * verification. > > - */ > > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > > if (!ctx) > > return false; > > > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > > - EVP_PKEY_CTX_free(ctx); > > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > > + > > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > > + pubkey_) <= 0) > > return false; > > - } > > > > - /* Calculate the SHA256 digest of the data. */ > > - uint8_t digest[SHA256_DIGEST_LENGTH]; > > - SHA256(data.data(), data.size(), digest); > > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > > + data.data(), data.size()); > > > > - /* Decrypt the signature and verify it matches the digest. */ > > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > > - SHA256_DIGEST_LENGTH); > > - EVP_PKEY_CTX_free(ctx); > > return ret == 1; > > + > > #elif HAVE_GNUTLS > > const gnutls_datum_t gnuTlsData{ > > const_cast<unsigned char *>(data.data()), > > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > static_cast<unsigned int>(sig.size()) > > }; > > > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > > + constexpr gnutls_sign_algorithm_t algo = > > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; > > Let's doy > > constexpr gnutls_sign_algorithm_t algo = [] { > constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; > > if constexpr (name == "ml-dsa-65") > return GNUTLS_SIGN_MLDSA65; > if constexpr (name == "rsa-sha256") > return GNUTLS_SIGN_RSA_SHA256; > } (); > > This way it should be a compilation error if you use an unexpected name for some reason. > > > + > > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > > &gnuTlsData, &gnuTlsSig); > > + > > return ret >= 0; > > #else > > return false;
Hi Barnabás, Thank you for reviewing. On Wed, Jul 1, 2026 at 4:56 AM Barnabás Pőcze <barnabas.pocze@ideasonboard.com> wrote: > > Hi > > 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > > With RSA slated for deprecation by 2035, the IPA signature algorithm must > > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > > varying levels of data integrity protection. ML-DSA-65 has been selected > > to sign the IPA due to its balanced performance for general-purpose > > applications. > > > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > > Signed-off-by: Kate Hsuan <hpa@redhat.com> > > --- > > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > > 1 file changed, 25 insertions(+), 20 deletions(-) > > > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > > index f1d73a5c..539a4e6d 100644 > > --- a/src/libcamera/pub_key.cpp > > +++ b/src/libcamera/pub_key.cpp > > @@ -14,8 +14,13 @@ > > #include <openssl/x509.h> > > #elif HAVE_GNUTLS > > #include <gnutls/abstract.h> > > +#include <gnutls/gnutls.h> > > #endif > > > > +#include <libcamera/base/utils.h> > > + > > +#include "libcamera/internal/pub_key.h" > > + > > /** > > * \file pub_key.ha > > * \brief Public key signature verification > > @@ -28,12 +33,17 @@ namespace libcamera { > > * \brief Public key wrapper for signature verification > > * > > * The PubKey class wraps a public key and implements signature verification. It > > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > > + * as specified in NIST FIPS 204. The signature algorithm is determined at > > + * compile time. > > */ > > > > /** > > * \brief Construct a PubKey from key data > > * \param[in] key Key data encoded in DER format > > + * > > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > > + * (verified as ML-DSA-65 according to FIPS 204). > > */ > > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > > : valid_(false) > > @@ -83,7 +93,7 @@ PubKey::~PubKey() > > * \param[in] sig The signature > > * > > * Verify that the signature \a sig matches the signed \a data for the public > > - * key. The signture algorithm is hardcoded to RSA-SHA256. > > + * key. > > * > > * \return True if the signature is valid, false otherwise > > */ > > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > return false; > > > > #if HAVE_CRYPTO > > Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked > with libcrypto is because it will automatically determine the correct algorithm > (from the public key or such?)? And I imagine that is not an option with gnutls? EVP_DigestVerify() works for both so IPA_MODULE_DIR_SIGNATURE_ALGO wasn't needed fro libcrypto. > > > > - /* > > - * Create and initialize a public key algorithm context for signature > > - * verification. > > - */ > > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > > if (!ctx) > > return false; > > > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > > - EVP_PKEY_CTX_free(ctx); > > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > > + > > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > > + pubkey_) <= 0) > > return false; > > - } > > > > - /* Calculate the SHA256 digest of the data. */ > > - uint8_t digest[SHA256_DIGEST_LENGTH]; > > - SHA256(data.data(), data.size(), digest); > > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > > + data.data(), data.size()); > > > > - /* Decrypt the signature and verify it matches the digest. */ > > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > > - SHA256_DIGEST_LENGTH); > > - EVP_PKEY_CTX_free(ctx); > > return ret == 1; > > + > > #elif HAVE_GNUTLS > > const gnutls_datum_t gnuTlsData{ > > const_cast<unsigned char *>(data.data()), > > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > static_cast<unsigned int>(sig.size()) > > }; > > > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > > + constexpr gnutls_sign_algorithm_t algo = > > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; > > Let's doy > > constexpr gnutls_sign_algorithm_t algo = [] { > constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; > > if constexpr (name == "ml-dsa-65") > return GNUTLS_SIGN_MLDSA65; > if constexpr (name == "rsa-sha256") > return GNUTLS_SIGN_RSA_SHA256; > } (); > > This way it should be a compilation error if you use an unexpected name for some reason. meson already verify the algorithm string but Laurent proposed a better way to distinguish the types of the algorithm for gnutls. Let's try that way. > > > + > > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > > &gnuTlsData, &gnuTlsSig); > > + > > return ret >= 0; > > #else > > return false; >
Hi Laurent and Barnabás On Wed, Jul 1, 2026 at 8:41 AM Laurent Pinchart <laurent.pinchart@ideasonboard.com> wrote: > > On Wed, Jul 01, 2026 at 10:56:09AM +0200, Barnabás Pőcze wrote: > > Hi > > > > 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > > > With RSA slated for deprecation by 2035, the IPA signature algorithm must > > > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > > > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > > > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > > > varying levels of data integrity protection. ML-DSA-65 has been selected > > > to sign the IPA due to its balanced performance for general-purpose > > > applications. > > > > > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > > > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > > > Signed-off-by: Kate Hsuan <hpa@redhat.com> > > > --- > > > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > > > 1 file changed, 25 insertions(+), 20 deletions(-) > > > > > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > > > index f1d73a5c..539a4e6d 100644 > > > --- a/src/libcamera/pub_key.cpp > > > +++ b/src/libcamera/pub_key.cpp > > > @@ -14,8 +14,13 @@ > > > #include <openssl/x509.h> > > > #elif HAVE_GNUTLS > > > #include <gnutls/abstract.h> > > > +#include <gnutls/gnutls.h> > > > #endif > > > > > > +#include <libcamera/base/utils.h> > > > + > > > +#include "libcamera/internal/pub_key.h" > > > + > > > /** > > > * \file pub_key.h > > > * \brief Public key signature verification > > > @@ -28,12 +33,17 @@ namespace libcamera { > > > * \brief Public key wrapper for signature verification > > > * > > > * The PubKey class wraps a public key and implements signature verification. It > > > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > > > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > > > + * as specified in NIST FIPS 204. The signature algorithm is determined at > > > + * compile time. > > > */ > > > > > > /** > > > * \brief Construct a PubKey from key data > > > * \param[in] key Key data encoded in DER format > > > + * > > > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > > > + * (verified as ML-DSA-65 according to FIPS 204). > > > */ > > > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > > > : valid_(false) > > > @@ -83,7 +93,7 @@ PubKey::~PubKey() > > > * \param[in] sig The signature > > > * > > > * Verify that the signature \a sig matches the signed \a data for the public > > > - * key. The signture algorithm is hardcoded to RSA-SHA256. > > > + * key. > > > * > > > * \return True if the signature is valid, false otherwise > > > */ > > > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > return false; > > > > > > #if HAVE_CRYPTO > > > > Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked > > with libcrypto is because it will automatically determine the correct algorithm > > (from the public key or such?)? And I imagine that is not an option with gnutls? > > The following seems to work for gnutls (error handling left as an > exercise for the reader): > > gnutls_digest_algorithm_t hash; > gnutls_pubkey_get_preferred_hash_algorithm(pubkey_, &hash, nullptr); > gnutls_pk_algorithm_t pkeyAlgo = static_cast<gnutls_pk_algorithm_t>(gnutls_pubkey_get_pk_algorithm(pubkey_, nullptr)); > gnutls_sign_algorithm_t algo = gnutls_pk_to_sign(pkeyAlgo, hash); > > It may be a bit complex and a bit fragile though. That means fetching the algorithm from the keys and libcamera may not follow the meson_option to work if two types of valid keys are availiable. I'll try to mix both suggestions and check the algorithm set via the meson option. > > > > - /* > > > - * Create and initialize a public key algorithm context for signature > > > - * verification. > > > - */ > > > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > > > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > > > if (!ctx) > > > return false; > > > > > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > > > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > > > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > > > - EVP_PKEY_CTX_free(ctx); > > > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > > > + > > > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > > > + pubkey_) <= 0) > > > return false; > > > - } > > > > > > - /* Calculate the SHA256 digest of the data. */ > > > - uint8_t digest[SHA256_DIGEST_LENGTH]; > > > - SHA256(data.data(), data.size(), digest); > > > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > > > + data.data(), data.size()); > > > > > > - /* Decrypt the signature and verify it matches the digest. */ > > > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > > > - SHA256_DIGEST_LENGTH); > > > - EVP_PKEY_CTX_free(ctx); > > > return ret == 1; > > > + > > > #elif HAVE_GNUTLS > > > const gnutls_datum_t gnuTlsData{ > > > const_cast<unsigned char *>(data.data()), > > > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > static_cast<unsigned int>(sig.size()) > > > }; > > > > > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > > > + constexpr gnutls_sign_algorithm_t algo = > > > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; > > > > Let's doy > > > > constexpr gnutls_sign_algorithm_t algo = [] { > > constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; > > > > if constexpr (name == "ml-dsa-65") > > return GNUTLS_SIGN_MLDSA65; > > if constexpr (name == "rsa-sha256") > > return GNUTLS_SIGN_RSA_SHA256; > > } (); > > > > This way it should be a compilation error if you use an unexpected name for some reason. > > > > > + > > > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > > > &gnuTlsData, &gnuTlsSig); > > > + > > > return ret >= 0; > > > #else > > > return false; > > -- > Regards, > > Laurent Pinchart >
On Wed, Jul 01, 2026 at 11:39:44PM -0400, Kate Hsuan wrote: > On Wed, Jul 1, 2026 at 8:41 AM Laurent Pinchart wrote: > > On Wed, Jul 01, 2026 at 10:56:09AM +0200, Barnabás Pőcze wrote: > > > 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > > > > With RSA slated for deprecation by 2035, the IPA signature algorithm must > > > > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > > > > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > > > > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > > > > varying levels of data integrity protection. ML-DSA-65 has been selected > > > > to sign the IPA due to its balanced performance for general-purpose > > > > applications. > > > > > > > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > > > > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > > > > Signed-off-by: Kate Hsuan <hpa@redhat.com> > > > > --- > > > > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > > > > 1 file changed, 25 insertions(+), 20 deletions(-) > > > > > > > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > > > > index f1d73a5c..539a4e6d 100644 > > > > --- a/src/libcamera/pub_key.cpp > > > > +++ b/src/libcamera/pub_key.cpp > > > > @@ -14,8 +14,13 @@ > > > > #include <openssl/x509.h> > > > > #elif HAVE_GNUTLS > > > > #include <gnutls/abstract.h> > > > > +#include <gnutls/gnutls.h> > > > > #endif > > > > > > > > +#include <libcamera/base/utils.h> > > > > + > > > > +#include "libcamera/internal/pub_key.h" > > > > + > > > > /** > > > > * \file pub_key.h > > > > * \brief Public key signature verification > > > > @@ -28,12 +33,17 @@ namespace libcamera { > > > > * \brief Public key wrapper for signature verification > > > > * > > > > * The PubKey class wraps a public key and implements signature verification. It > > > > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > > > > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > > > > + * as specified in NIST FIPS 204. The signature algorithm is determined at > > > > + * compile time. > > > > */ > > > > > > > > /** > > > > * \brief Construct a PubKey from key data > > > > * \param[in] key Key data encoded in DER format > > > > + * > > > > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > > > > + * (verified as ML-DSA-65 according to FIPS 204). > > > > */ > > > > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > > > > : valid_(false) > > > > @@ -83,7 +93,7 @@ PubKey::~PubKey() > > > > * \param[in] sig The signature > > > > * > > > > * Verify that the signature \a sig matches the signed \a data for the public > > > > - * key. The signture algorithm is hardcoded to RSA-SHA256. > > > > + * key. > > > > * > > > > * \return True if the signature is valid, false otherwise > > > > */ > > > > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > > return false; > > > > > > > > #if HAVE_CRYPTO > > > > > > Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked > > > with libcrypto is because it will automatically determine the correct algorithm > > > (from the public key or such?)? And I imagine that is not an option with gnutls? > > > > The following seems to work for gnutls (error handling left as an > > exercise for the reader): > > > > gnutls_digest_algorithm_t hash; > > gnutls_pubkey_get_preferred_hash_algorithm(pubkey_, &hash, nullptr); > > gnutls_pk_algorithm_t pkeyAlgo = static_cast<gnutls_pk_algorithm_t>(gnutls_pubkey_get_pk_algorithm(pubkey_, nullptr)); > > gnutls_sign_algorithm_t algo = gnutls_pk_to_sign(pkeyAlgo, hash); > > > > It may be a bit complex and a bit fragile though. > > That means fetching the algorithm from the keys and libcamera may not > follow the meson_option to work if two types of valid keys are > availiable. > I'll try to mix both suggestions and check the algorithm set via the > meson option. Please note that I'm not sure the complexity of the above code is worth it, especially after adding error checking. For MLDSA65 keys there's a single possible signature algorithm, but for RSA keys I think multiple options are possible. gnutls_pubkey_get_preferred_hash_algorithm() returns the SHA256 digest, I suppose that's not an implementation details of gnutls, but I'm not 100% sure. > > > > - /* > > > > - * Create and initialize a public key algorithm context for signature > > > > - * verification. > > > > - */ > > > > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > > > > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > > > > if (!ctx) > > > > return false; > > > > > > > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > > > > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > > > > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > > > > - EVP_PKEY_CTX_free(ctx); > > > > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > > > > + > > > > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > > > > + pubkey_) <= 0) > > > > return false; > > > > - } > > > > > > > > - /* Calculate the SHA256 digest of the data. */ > > > > - uint8_t digest[SHA256_DIGEST_LENGTH]; > > > > - SHA256(data.data(), data.size(), digest); > > > > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > > > > + data.data(), data.size()); > > > > > > > > - /* Decrypt the signature and verify it matches the digest. */ > > > > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > > > > - SHA256_DIGEST_LENGTH); > > > > - EVP_PKEY_CTX_free(ctx); > > > > return ret == 1; > > > > + > > > > #elif HAVE_GNUTLS > > > > const gnutls_datum_t gnuTlsData{ > > > > const_cast<unsigned char *>(data.data()), > > > > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > > static_cast<unsigned int>(sig.size()) > > > > }; > > > > > > > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > > > > + constexpr gnutls_sign_algorithm_t algo = > > > > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; > > > > > > Let's doy > > > > > > constexpr gnutls_sign_algorithm_t algo = [] { > > > constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; > > > > > > if constexpr (name == "ml-dsa-65") > > > return GNUTLS_SIGN_MLDSA65; > > > if constexpr (name == "rsa-sha256") > > > return GNUTLS_SIGN_RSA_SHA256; > > > } (); > > > > > > This way it should be a compilation error if you use an unexpected name for some reason. > > > > > > > + > > > > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > > > > &gnuTlsData, &gnuTlsSig); > > > > + > > > > return ret >= 0; > > > > #else > > > > return false;
Hi Laurent, On Thu, Jul 2, 2026 at 4:28 PM Laurent Pinchart <laurent.pinchart@ideasonboard.com> wrote: > > On Wed, Jul 01, 2026 at 11:39:44PM -0400, Kate Hsuan wrote: > > On Wed, Jul 1, 2026 at 8:41 AM Laurent Pinchart wrote: > > > On Wed, Jul 01, 2026 at 10:56:09AM +0200, Barnabás Pőcze wrote: > > > > 2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta: > > > > > With RSA slated for deprecation by 2035, the IPA signature algorithm must > > > > > be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, > > > > > we are adopting the NIST-finalized ML-DSA signature scheme. Among the > > > > > available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer > > > > > varying levels of data integrity protection. ML-DSA-65 has been selected > > > > > to sign the IPA due to its balanced performance for general-purpose > > > > > applications. > > > > > > > > > > Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) > > > > > Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf > > > > > Signed-off-by: Kate Hsuan <hpa@redhat.com> > > > > > --- > > > > > src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- > > > > > 1 file changed, 25 insertions(+), 20 deletions(-) > > > > > > > > > > diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp > > > > > index f1d73a5c..539a4e6d 100644 > > > > > --- a/src/libcamera/pub_key.cpp > > > > > +++ b/src/libcamera/pub_key.cpp > > > > > @@ -14,8 +14,13 @@ > > > > > #include <openssl/x509.h> > > > > > #elif HAVE_GNUTLS > > > > > #include <gnutls/abstract.h> > > > > > +#include <gnutls/gnutls.h> > > > > > #endif > > > > > > > > > > +#include <libcamera/base/utils.h> > > > > > + > > > > > +#include "libcamera/internal/pub_key.h" > > > > > + > > > > > /** > > > > > * \file pub_key.h > > > > > * \brief Public key signature verification > > > > > @@ -28,12 +33,17 @@ namespace libcamera { > > > > > * \brief Public key wrapper for signature verification > > > > > * > > > > > * The PubKey class wraps a public key and implements signature verification. It > > > > > - * only supports RSA keys and the RSA-SHA256 signature algorithm. > > > > > + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys > > > > > + * as specified in NIST FIPS 204. The signature algorithm is determined at > > > > > + * compile time. > > > > > */ > > > > > > > > > > /** > > > > > * \brief Construct a PubKey from key data > > > > > * \param[in] key Key data encoded in DER format > > > > > + * > > > > > + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 > > > > > + * (verified as ML-DSA-65 according to FIPS 204). > > > > > */ > > > > > PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) > > > > > : valid_(false) > > > > > @@ -83,7 +93,7 @@ PubKey::~PubKey() > > > > > * \param[in] sig The signature > > > > > * > > > > > * Verify that the signature \a sig matches the signed \a data for the public > > > > > - * key. The signture algorithm is hardcoded to RSA-SHA256. > > > > > + * key. > > > > > * > > > > > * \return True if the signature is valid, false otherwise > > > > > */ > > > > > @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > > > return false; > > > > > > > > > > #if HAVE_CRYPTO > > > > > > > > Just for my understanding, the reason `IPA_MODULE_DIR_SIGNATURE_ALGO` is not checked > > > > with libcrypto is because it will automatically determine the correct algorithm > > > > (from the public key or such?)? And I imagine that is not an option with gnutls? > > > > > > The following seems to work for gnutls (error handling left as an > > > exercise for the reader): > > > > > > gnutls_digest_algorithm_t hash; > > > gnutls_pubkey_get_preferred_hash_algorithm(pubkey_, &hash, nullptr); > > > gnutls_pk_algorithm_t pkeyAlgo = static_cast<gnutls_pk_algorithm_t>(gnutls_pubkey_get_pk_algorithm(pubkey_, nullptr)); > > > gnutls_sign_algorithm_t algo = gnutls_pk_to_sign(pkeyAlgo, hash); > > > > > > It may be a bit complex and a bit fragile though. > > > > That means fetching the algorithm from the keys and libcamera may not > > follow the meson_option to work if two types of valid keys are > > availiable. > > I'll try to mix both suggestions and check the algorithm set via the > > meson option. > > Please note that I'm not sure the complexity of the above code is worth > it, especially after adding error checking. For MLDSA65 keys there's a > single possible signature algorithm, but for RSA keys I think multiple > options are possible. gnutls_pubkey_get_preferred_hash_algorithm() > returns the SHA256 digest, I suppose that's not an implementation > details of gnutls, but I'm not 100% sure. I proposed a generic way in v5 to verify both RAS and ML-DSA so the conditional compilation is not necessary. For now, both RSA and ML-DSA are supported. Moreover, the special case for ML-DSA is also considered. (hash algorithm is GNUTLS_DIG_UNKNOWN) Let's see if it is a better way for the implementation. > > > > > > - /* > > > > > - * Create and initialize a public key algorithm context for signature > > > > > - * verification. > > > > > - */ > > > > > - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); > > > > > + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); > > > > > if (!ctx) > > > > > return false; > > > > > > > > > > - if (EVP_PKEY_verify_init(ctx) <= 0 || > > > > > - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || > > > > > - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { > > > > > - EVP_PKEY_CTX_free(ctx); > > > > > + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); > > > > > + > > > > > + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, > > > > > + pubkey_) <= 0) > > > > > return false; > > > > > - } > > > > > > > > > > - /* Calculate the SHA256 digest of the data. */ > > > > > - uint8_t digest[SHA256_DIGEST_LENGTH]; > > > > > - SHA256(data.data(), data.size(), digest); > > > > > + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), > > > > > + data.data(), data.size()); > > > > > > > > > > - /* Decrypt the signature and verify it matches the digest. */ > > > > > - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, > > > > > - SHA256_DIGEST_LENGTH); > > > > > - EVP_PKEY_CTX_free(ctx); > > > > > return ret == 1; > > > > > + > > > > > #elif HAVE_GNUTLS > > > > > const gnutls_datum_t gnuTlsData{ > > > > > const_cast<unsigned char *>(data.data()), > > > > > @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, > > > > > static_cast<unsigned int>(sig.size()) > > > > > }; > > > > > > > > > > - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, > > > > > + constexpr gnutls_sign_algorithm_t algo = > > > > > + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; > > > > > > > > Let's doy > > > > > > > > constexpr gnutls_sign_algorithm_t algo = [] { > > > > constexpr std::string_view name = IPA_MODULE_DIR_SIGNATURE_ALGO; > > > > > > > > if constexpr (name == "ml-dsa-65") > > > > return GNUTLS_SIGN_MLDSA65; > > > > if constexpr (name == "rsa-sha256") > > > > return GNUTLS_SIGN_RSA_SHA256; > > > > } (); > > > > > > > > This way it should be a compilation error if you use an unexpected name for some reason. > > > > > > > > > + > > > > > + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, > > > > > &gnuTlsData, &gnuTlsSig); > > > > > + > > > > > return ret >= 0; > > > > > #else > > > > > return false; > > -- > Regards, > > Laurent Pinchart >
diff --git a/src/libcamera/pub_key.cpp b/src/libcamera/pub_key.cpp index f1d73a5c..539a4e6d 100644 --- a/src/libcamera/pub_key.cpp +++ b/src/libcamera/pub_key.cpp @@ -14,8 +14,13 @@ #include <openssl/x509.h> #elif HAVE_GNUTLS #include <gnutls/abstract.h> +#include <gnutls/gnutls.h> #endif +#include <libcamera/base/utils.h> + +#include "libcamera/internal/pub_key.h" + /** * \file pub_key.h * \brief Public key signature verification @@ -28,12 +33,17 @@ namespace libcamera { * \brief Public key wrapper for signature verification * * The PubKey class wraps a public key and implements signature verification. It - * only supports RSA keys and the RSA-SHA256 signature algorithm. + * supports RSA keys with the RSA-SHA256 signature algorithm, or ML-DSA-65 keys + * as specified in NIST FIPS 204. The signature algorithm is determined at + * compile time. */ /** * \brief Construct a PubKey from key data * \param[in] key Key data encoded in DER format + * + * Supported key types are RSA (verified with RSA-SHA256) and ML-DSA-65 + * (verified as ML-DSA-65 according to FIPS 204). */ PubKey::PubKey([[maybe_unused]] Span<const uint8_t> key) : valid_(false) @@ -83,7 +93,7 @@ PubKey::~PubKey() * \param[in] sig The signature * * Verify that the signature \a sig matches the signed \a data for the public - * key. The signture algorithm is hardcoded to RSA-SHA256. + * key. * * \return True if the signature is valid, false otherwise */ @@ -94,30 +104,21 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, return false; #if HAVE_CRYPTO - /* - * Create and initialize a public key algorithm context for signature - * verification. - */ - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pubkey_, nullptr); + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); if (!ctx) return false; - if (EVP_PKEY_verify_init(ctx) <= 0 || - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0 || - EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0) { - EVP_PKEY_CTX_free(ctx); + utils::scope_exit ctxGuard([&] { EVP_MD_CTX_free(ctx); }); + + if (EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, + pubkey_) <= 0) return false; - } - /* Calculate the SHA256 digest of the data. */ - uint8_t digest[SHA256_DIGEST_LENGTH]; - SHA256(data.data(), data.size(), digest); + int ret = EVP_DigestVerify(ctx, sig.data(), sig.size(), + data.data(), data.size()); - /* Decrypt the signature and verify it matches the digest. */ - int ret = EVP_PKEY_verify(ctx, sig.data(), sig.size(), digest, - SHA256_DIGEST_LENGTH); - EVP_PKEY_CTX_free(ctx); return ret == 1; + #elif HAVE_GNUTLS const gnutls_datum_t gnuTlsData{ const_cast<unsigned char *>(data.data()), @@ -129,8 +130,12 @@ bool PubKey::verify([[maybe_unused]] Span<const uint8_t> data, static_cast<unsigned int>(sig.size()) }; - int ret = gnutls_pubkey_verify_data2(pubkey_, GNUTLS_SIGN_RSA_SHA256, 0, + constexpr gnutls_sign_algorithm_t algo = + std::string(IPA_MODULE_DIR_SIGNATURE_ALGO) == std::string("ml-dsa-65") ? GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256; + + int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, &gnuTlsData, &gnuTlsSig); + return ret >= 0; #else return false;
With RSA slated for deprecation by 2035, the IPA signature algorithm must be migrated to a Post-Quantum Cryptography (PQC) standard. Accordingly, we are adopting the NIST-finalized ML-DSA signature scheme. Among the available variants, ML-DSA-44, ML-DSA-65, and ML-DSA-87, which offer varying levels of data integrity protection. ML-DSA-65 has been selected to sign the IPA due to its balanced performance for general-purpose applications. Link: https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) Link: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf Signed-off-by: Kate Hsuan <hpa@redhat.com> --- src/libcamera/pub_key.cpp | 45 ++++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 20 deletions(-)