Classical signature schemes such as RSA and ECDSA are vulnerable to attacks by sufficiently powerful quantum computers. This series adds ML-DSA verification as a first step towards post-quantum cryptography (PQC) support in U-Boot.
This RFC adds generic verification support for pure FIPS 204 ML-DSA without an external message prehash. SHAKE hashing remains part of the ML-DSA algorithm. HashML-DSA is not supported. See FIPS 204 Section 5.3: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf It supports ML-DSA-44, ML-DSA-65 and ML-DSA-87. The implementation is verification-only. It contains no target signing code or private-key handling. This series targets U-Boot proper. SPL support is not included. Verification allocates approximately 8 to 12 KB of heap workspace depending on the parameter set and ABI alignment. This excludes allocator overhead. Any future SPL integration will need to account for heap availability, stack usage and code size. The verifier is adapted from the Linux crypto library implementation. The series preserves the Linux licensing, copyright notices and source provenance. Linux facilities are replaced with direct U-Boot equivalents where needed. ML-DSA requires SHAKE128 and SHAKE256. The series adds generic one-shot and incremental SHAKE interfaces backed by Keccak-f[1600]. This code can be used by consumers other than ML-DSA. The public ML-DSA API accepts raw FIPS 204 public keys, raw signatures and one contiguous message. The tests are based on Linux KUnit tests and cover all three ML-DSA parameter sets with valid and invalid inputs. SHAKE128 and SHAKE256 are checked against FIPS 202 known answers. Validated with sandbox and qemu_arm64_defconfig builds plus the SHAKE and ML-DSA unit tests on sandbox. This series does not add FIT semantics or mkimage signing. A follow-up series can add a generic incremental transcript, target FIT verification and host signing. Feedback is welcome on the public API and Kconfig placement. Ayoub Zaki (4): crypto: add SHAKE128 and SHAKE256 support crypto: add FIPS 204 ML-DSA verification test: add ML-DSA verification tests doc: describe ML-DSA verification doc/develop/index.rst | 1 + doc/develop/mldsa.rst | 67 ++ include/crypto/mldsa.h | 67 ++ include/crypto/sha3.h | 353 +++++++ lib/Kconfig | 14 + lib/crypto/Makefile | 3 + lib/crypto/mldsa.c | 679 +++++++++++++ lib/crypto/sha3.c | 382 ++++++++ test/Kconfig | 9 + test/lib/Makefile | 1 + test/lib/mldsa-testvecs.h | 1896 +++++++++++++++++++++++++++++++++++++ test/lib/mldsa.c | 383 ++++++++ 12 files changed, 3855 insertions(+) create mode 100644 doc/develop/mldsa.rst create mode 100644 include/crypto/mldsa.h create mode 100644 include/crypto/sha3.h create mode 100644 lib/crypto/mldsa.c create mode 100644 lib/crypto/sha3.c create mode 100644 test/lib/mldsa-testvecs.h create mode 100644 test/lib/mldsa.c -- 2.43.0
