diff options
| author | David Howells <dhowells@redhat.com> | 2025-10-17 08:46:43 +0100 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2026-01-30 11:34:34 +0000 |
| commit | 8bbdeb7a25b4cd3d829136a2e12982b8ee7d7991 (patch) | |
| tree | ec11a5f67add7bd6883c43de2c38a764f3e1cd38 /crypto/asymmetric_keys/x509_cert_parser.c | |
| parent | f3eccecd782dbaf33d5ad0d1fd22ea277300acdb (diff) | |
| download | linux-next-8bbdeb7a25b4cd3d829136a2e12982b8ee7d7991.tar.gz linux-next-8bbdeb7a25b4cd3d829136a2e12982b8ee7d7991.zip | |
pkcs7, x509: Add ML-DSA support
Add support for ML-DSA keys and signatures to the CMS/PKCS#7 and X.509
implementations. ML-DSA-44, -65 and -87 are all supported. For X.509
certificates, the TBSCertificate is required to be signed directly; for
CMS, direct signing of the data is preferred, though use of SHA512 (and
only that) as an intermediate hash of the content is permitted with
signedAttrs.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Lukas Wunner <lukas@wunner.de>
cc: Ignat Korchagin <ignat@cloudflare.com>
cc: Stephan Mueller <smueller@chronox.de>
cc: Eric Biggers <ebiggers@kernel.org>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
Diffstat (limited to 'crypto/asymmetric_keys/x509_cert_parser.c')
| -rw-r--r-- | crypto/asymmetric_keys/x509_cert_parser.c | 27 |
1 files changed, 26 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index b37cae914987..2fe094f5caf3 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -257,6 +257,15 @@ int x509_note_sig_algo(void *context, size_t hdrlen, unsigned char tag, case OID_gost2012Signature512: ctx->cert->sig->hash_algo = "streebog512"; goto ecrdsa; + case OID_id_ml_dsa_44: + ctx->cert->sig->pkey_algo = "mldsa44"; + goto ml_dsa; + case OID_id_ml_dsa_65: + ctx->cert->sig->pkey_algo = "mldsa65"; + goto ml_dsa; + case OID_id_ml_dsa_87: + ctx->cert->sig->pkey_algo = "mldsa87"; + goto ml_dsa; } rsa_pkcs1: @@ -274,6 +283,12 @@ ecdsa: ctx->cert->sig->encoding = "x962"; ctx->sig_algo = ctx->last_oid; return 0; +ml_dsa: + ctx->cert->sig->algo_takes_data = true; + ctx->cert->sig->hash_algo = "none"; + ctx->cert->sig->encoding = "raw"; + ctx->sig_algo = ctx->last_oid; + return 0; } /* @@ -300,7 +315,8 @@ int x509_note_signature(void *context, size_t hdrlen, if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 || strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 || - strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0) { + strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0 || + strncmp(ctx->cert->sig->pkey_algo, "mldsa", 5) == 0) { /* Discard the BIT STRING metadata */ if (vlen < 1 || *(const u8 *)value != 0) return -EBADMSG; @@ -524,6 +540,15 @@ int x509_extract_key_data(void *context, size_t hdrlen, return -ENOPKG; } break; + case OID_id_ml_dsa_44: + ctx->cert->pub->pkey_algo = "mldsa44"; + break; + case OID_id_ml_dsa_65: + ctx->cert->pub->pkey_algo = "mldsa65"; + break; + case OID_id_ml_dsa_87: + ctx->cert->pub->pkey_algo = "mldsa87"; + break; default: return -ENOPKG; } |