On Wed, Jan 21, 2026 at 10:36:06PM +0000, David Howells wrote:
> Add support for ML-DSA keys and signatures to the CMS/PKCS#7 and X.509
> implementations. ML-DSA-44, -65 and -87 are all supported. For X.509
> certificates, the TBSCertificate is required to be signed directly; for CMS,
> direct signing of the data is preferred, though use of SHA512 (and only that)
> as an intermediate hash of the content is permitted with signedAttrs.
>
> Signed-off-by: David Howells <[email protected]>
> cc: Lukas Wunner <[email protected]>
> cc: Ignat Korchagin <[email protected]>
> cc: Stephan Mueller <[email protected]>
> cc: Eric Biggers <[email protected]>
> cc: Herbert Xu <[email protected]>
> cc: [email protected]
> cc: [email protected]
> ---
> crypto/asymmetric_keys/pkcs7_parser.c | 24 +++++++++++++++++++-
> crypto/asymmetric_keys/public_key.c | 10 +++++++++
> crypto/asymmetric_keys/x509_cert_parser.c | 27 ++++++++++++++++++++++-
> include/linux/oid_registry.h | 5 +++++
> 4 files changed, 64 insertions(+), 2 deletions(-)
>
> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c
> b/crypto/asymmetric_keys/pkcs7_parser.c
> index 3cdbab3b9f50..594a8f1d9dfb 100644
> --- a/crypto/asymmetric_keys/pkcs7_parser.c
> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
> @@ -95,11 +95,18 @@ static int pkcs7_check_authattrs(struct pkcs7_message
> *msg)
> if (sinfo->authattrs) {
> want = true;
> msg->have_authattrs = true;
> + } else if (sinfo->sig->algo_takes_data) {
> + sinfo->sig->hash_algo = "none";
> }
>
> - for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
> + for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next) {
> if (!!sinfo->authattrs != want)
> goto inconsistent;
> +
> + if (!sinfo->authattrs &&
> + sinfo->sig->algo_takes_data)
> + sinfo->sig->hash_algo = "none";
Why don't we have a constant for "none"?
$ git grep "\"none\"" security/
security/apparmor/audit.c: "none",
security/apparmor/lib.c: { "none", DEBUG_NONE },
security/security.c: [LOCKDOWN_NONE] = "none",
$ git grep "\"none\"" crypto
crypto/asymmetric_keys/public_key.c:
hash_algo = "none";
crypto/asymmetric_keys/public_key.c: hash_algo =
"none";
crypto/testmgr.h: * PKCS#1 RSA test vectors for hash algorithm "none"
IMHO, this a bad practice.
> + }
> return 0;
>
> inconsistent:
> @@ -297,6 +304,21 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t
> hdrlen,
> ctx->sinfo->sig->pkey_algo = "ecrdsa";
> ctx->sinfo->sig->encoding = "raw";
> break;
> + case OID_id_ml_dsa_44:
> + ctx->sinfo->sig->pkey_algo = "mldsa44";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> + case OID_id_ml_dsa_65:
> + ctx->sinfo->sig->pkey_algo = "mldsa65";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> + case OID_id_ml_dsa_87:
> + ctx->sinfo->sig->pkey_algo = "mldsa87";
> + ctx->sinfo->sig->encoding = "raw";
> + ctx->sinfo->sig->algo_takes_data = true;
> + break;
> default:
> printk("Unsupported pkey algo: %u\n", ctx->last_oid);
> return -ENOPKG;
> diff --git a/crypto/asymmetric_keys/public_key.c
> b/crypto/asymmetric_keys/public_key.c
> index a46356e0c08b..09a0b83d5d77 100644
> --- a/crypto/asymmetric_keys/public_key.c
> +++ b/crypto/asymmetric_keys/public_key.c
> @@ -142,6 +142,16 @@ software_key_determine_akcipher(const struct public_key
> *pkey,
> if (strcmp(hash_algo, "streebog256") != 0 &&
> strcmp(hash_algo, "streebog512") != 0)
> return -EINVAL;
> + } else if (strcmp(pkey->pkey_algo, "mldsa44") == 0 ||
> + strcmp(pkey->pkey_algo, "mldsa65") == 0 ||
> + strcmp(pkey->pkey_algo, "mldsa87") == 0) {
> + if (strcmp(encoding, "raw") != 0)
> + return -EINVAL;
> + if (!hash_algo)
> + return -EINVAL;
> + if (strcmp(hash_algo, "none") != 0 &&
> + strcmp(hash_algo, "sha512") != 0)
> + return -EINVAL;
> } else {
> /* Unknown public key algorithm */
> return -ENOPKG;
> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c
> b/crypto/asymmetric_keys/x509_cert_parser.c
> index b37cae914987..2fe094f5caf3 100644
> --- a/crypto/asymmetric_keys/x509_cert_parser.c
> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
> @@ -257,6 +257,15 @@ int x509_note_sig_algo(void *context, size_t hdrlen,
> unsigned char tag,
> case OID_gost2012Signature512:
> ctx->cert->sig->hash_algo = "streebog512";
> goto ecrdsa;
> + case OID_id_ml_dsa_44:
> + ctx->cert->sig->pkey_algo = "mldsa44";
> + goto ml_dsa;
> + case OID_id_ml_dsa_65:
> + ctx->cert->sig->pkey_algo = "mldsa65";
> + goto ml_dsa;
> + case OID_id_ml_dsa_87:
> + ctx->cert->sig->pkey_algo = "mldsa87";
> + goto ml_dsa;
> }
>
> rsa_pkcs1:
> @@ -274,6 +283,12 @@ int x509_note_sig_algo(void *context, size_t hdrlen,
> unsigned char tag,
> ctx->cert->sig->encoding = "x962";
> ctx->sig_algo = ctx->last_oid;
> return 0;
> +ml_dsa:
> + ctx->cert->sig->algo_takes_data = true;
> + ctx->cert->sig->hash_algo = "none";
> + ctx->cert->sig->encoding = "raw";
> + ctx->sig_algo = ctx->last_oid;
> + return 0;
> }
>
> /*
> @@ -300,7 +315,8 @@ int x509_note_signature(void *context, size_t hdrlen,
>
> if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
> strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 ||
> - strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0) {
> + strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0 ||
> + strncmp(ctx->cert->sig->pkey_algo, "mldsa", 5) == 0) {
> /* Discard the BIT STRING metadata */
> if (vlen < 1 || *(const u8 *)value != 0)
> return -EBADMSG;
> @@ -524,6 +540,15 @@ int x509_extract_key_data(void *context, size_t hdrlen,
> return -ENOPKG;
> }
> break;
> + case OID_id_ml_dsa_44:
> + ctx->cert->pub->pkey_algo = "mldsa44";
> + break;
> + case OID_id_ml_dsa_65:
> + ctx->cert->pub->pkey_algo = "mldsa65";
> + break;
> + case OID_id_ml_dsa_87:
> + ctx->cert->pub->pkey_algo = "mldsa87";
> + break;
> default:
> return -ENOPKG;
> }
> diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h
> index 6de479ebbe5d..ebce402854de 100644
> --- a/include/linux/oid_registry.h
> +++ b/include/linux/oid_registry.h
> @@ -145,6 +145,11 @@ enum OID {
> OID_id_rsassa_pkcs1_v1_5_with_sha3_384, /* 2.16.840.1.101.3.4.3.15 */
> OID_id_rsassa_pkcs1_v1_5_with_sha3_512, /* 2.16.840.1.101.3.4.3.16 */
>
> + /* NIST FIPS-204 ML-DSA */
> + OID_id_ml_dsa_44, /* 2.16.840.1.101.3.4.3.17 */
> + OID_id_ml_dsa_65, /* 2.16.840.1.101.3.4.3.18 */
> + OID_id_ml_dsa_87, /* 2.16.840.1.101.3.4.3.19 */
> +
> OID__NR
> };
>
>
BR, Jarkko
