Hi Ayoub, On 2026-09-18T17:21:23, Ayoub Zaki <[email protected]> wrote: > crypto: add FIPS 204 ML-DSA verification > > Port the Linux verify-only ML-DSA implementation introduced by commit > 64edccea594cf7cb1e2975fdf44531e3377b32db. Include the API > documentation update from commit > ffd42b6d0420c4be97cc28fd1bb5f4c29e286e98. > > Support all three FIPS 204 parameter sets with raw keys and raw > signatures. Do not add signing, private-key handling, FIT integration > or an external library dependency. > > Keep the initial public API aligned with Linux. It accepts one > contiguous message. Defer FIT integration to a separate series. > > Add U-Boot argument validation for invalid parameter-set values. > Reject a NULL message when its length is nonzero. > > Signed-off-by: Ayoub Zaki <[email protected]> > > include/crypto/mldsa.h | 67 +++++ > lib/Kconfig | 14 + > lib/crypto/Makefile | 3 + > lib/crypto/mldsa.c | 679 > +++++++++++++++++++++++++++++++++++++++++++++++++ > 4 files changed, 763 insertions(+)
I'm reviewing this but of course it depends on the outcome of the mbedtls discussion. > diff --git a/lib/Kconfig b/lib/Kconfig > @@ -634,6 +640,14 @@ config SM3 > +config MLDSA_VERIFY > + bool "Enable ML-DSA signature verification" > + select SHAKE You asked about Kconfig placement. ML-DSA is a signature scheme, not a hash, so it fits better in the "Security support" menu next to lib/ecdsa/Kconfig and lib/rsa/Kconfig than under "Hashing Support", e.g. as lib/mldsa/Kconfig or inside lib/crypto/Kconfig. Then when FIT support arrives, it will sit alongside the other verification options it has to interact with. What do you think? > diff --git a/include/crypto/mldsa.h b/include/crypto/mldsa.h > @@ -0,0 +1,67 @@ > + * Return: > + * * 0 if the signature is valid > + * * -EBADMSG if the signature and/or public key is malformed > + * * -EKEYREJECTED if the signature is invalid but otherwise well-formed > + * * -ENOMEM if out of memory so the validity of the signature is unknown > + */ The U-Boot-specific checks in mldsa_verify() return -EINVAL, which is missing from this list. Please can you add it? > diff --git a/lib/crypto/mldsa.c b/lib/crypto/mldsa.c > @@ -0,0 +1,679 @@ > + if (alg < MLDSA44 || alg > MLDSA87) > + return -EINVAL; If the enum has an unsigned underlying type, 'alg < MLDSA44' is always false and -Wtype-limits warns about it. Checking '(unsigned int)alg >= ARRAY_SIZE(mldsa_parameter_sets)' avoids that and stays correct if a parameter set is added later. > diff --git a/lib/crypto/mldsa.c b/lib/crypto/mldsa.c > @@ -0,0 +1,679 @@ > + * For freeing it, use kfree_sensitive() rather than kfree(). This is > + * mainly to comply with FIPS 204 Section 3.6.3 "Intermediate Values". > + * In reality it's a bit gratuitous, as this is a public key operation. > + */ This comment is out of date, since the port uses memset()/barrier_data()/free(). It also contradicts the doc in patch 4. Please can you update it to describe what the code actually does? Regards, Simon
