From: "Becker, Hanno" <beckphan@amazon.co.uk>
To: Eric Biggers <ebiggers@kernel.org>
Cc: "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
"David Howells" <dhowells@redhat.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"Luis Chamberlain" <mcgrof@kernel.org>,
Petr Pavlu <petr.pavlu@suse.com>,
"Daniel Gomez" <da.gomez@kernel.org>,
Sami Tolvanen <samitolvanen@google.com>,
"Jason A . Donenfeld" <Jason@zx2c4.com>,
Ard Biesheuvel <ardb@kernel.org>,
"Stephan Mueller" <smueller@chronox.de>,
Lukas Wunner <lukas@wunner.de>,
"Ignat Korchagin" <ignat@cloudflare.com>,
"keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
"linux-modules@vger.kernel.org" <linux-modules@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"matthias@kannwischer.eu" <matthias@kannwischer.eu>
Subject: Re: [PATCH 1/4] lib/crypto: Add ML-DSA verification support
Date: Sat, 29 Nov 2025 20:00:17 +0000 [thread overview]
Message-ID: <A7135B59-BAB5-451E-AD71-971F828054F0@amazon.co.uk> (raw)
In-Reply-To: <20251120003653.335863-2-ebiggers@kernel.org>
It looks like this may be close, but for the record:
The LF has a dedicated project for ML-DSA: https://github.com/pq-code-package/mldsa-native (part of the Post-Quantum Cryptography Alliance). It's derived from the reference implementation and adds automatically verified memory-safety + type-safety (= bounds-tracking) and a uniform backend interface for assembly optimizations; see the README for more details. It's licensed under Apache-2.0 OR MIT OR ISC.
If you are sure that the kernel will never need sign/keygen support, or support for optimized assembly, the current ad-hoc patch may be fine. Otherwise, the challenges are likely just delayed, e.g. how to safely re-use parts of the current code for the timing-sensitive signing, or in contexts with other bounds assumptions, or how to integrate assembly optimizations. It may not seem so, but this is difficult to get right and where maintainability gets challenging.
Verification here is a vehicle for maintainability: If you change any arithmetic code -- say you decide to do less modular reduction for performance -- you currently need very careful review that the bounds still check out in the worst case. In mldsa-native, this is re-checked automatically.
mldsa-native is production-ready and in the process of being integrated into Amazon's AWS-LC crypto library; the sibling-project mlkem-native https://github.com/pq-code-package/mlkem-native already has been. mldsa-native is not yet a drop-in for the kernel, however. At the least, memory usage needs to be brought down and allocation be made flexible. We're working on it, and if the kernel community was interested in it, it'd give impetus to accelerate the work.
This is just so you're aware. If mldsa-native is of interest, let us know -- it would be great to collaborate across the LF instead of duplicating efforts.
Thanks,
Hanno & Matthias (maintainers of mldsa-native)
next prev parent reply other threads:[~2025-11-29 20:00 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-20 0:36 [PATCH 0/4] lib/crypto: ML-DSA verification support Eric Biggers
2025-11-20 0:36 ` [PATCH 1/4] lib/crypto: Add " Eric Biggers
2025-11-20 8:14 ` David Howells
2025-11-21 2:15 ` Eric Biggers
2025-11-20 9:10 ` David Howells
2025-11-21 0:09 ` Eric Biggers
2025-11-20 13:55 ` David Howells
2025-11-21 0:50 ` Eric Biggers
2025-11-21 12:41 ` David Howells
2025-11-21 17:14 ` Eric Biggers
2025-11-21 17:41 ` David Howells
2025-11-25 4:29 ` Eric Biggers
2025-11-21 21:39 ` David Howells
2025-11-21 22:23 ` Eric Biggers
2025-11-21 22:29 ` Lukas Wunner
2025-11-21 22:48 ` Eric Biggers
2025-11-29 20:00 ` Becker, Hanno [this message]
2025-11-30 0:19 ` Eric Biggers
2025-11-30 1:05 ` Jason A. Donenfeld
2025-11-30 7:15 ` Becker, Hanno
2025-11-30 19:06 ` Eric Biggers
2025-11-20 0:36 ` [PATCH 2/4] lib/crypto: tests: Add KUnit tests for ML-DSA Eric Biggers
2025-11-20 2:29 ` Elliott, Robert (Servers)
2025-11-20 0:36 ` [PATCH 3/4] lib/crypto: tests: Add ML-DSA-65 test cases Eric Biggers
2025-11-20 0:36 ` [PATCH 4/4] lib/crypto: tests: Add ML-DSA-87 " Eric Biggers
2025-11-20 8:11 ` [PATCH 0/4] lib/crypto: ML-DSA verification support David Howells
2025-11-21 6:16 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=A7135B59-BAB5-451E-AD71-971F828054F0@amazon.co.uk \
--to=beckphan@amazon.co.uk \
--cc=20251120003653.335863-2-ebiggers@kernel.org \
--cc=Jason@zx2c4.com \
--cc=ardb@kernel.org \
--cc=da.gomez@kernel.org \
--cc=dhowells@redhat.com \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=ignat@cloudflare.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-modules@vger.kernel.org \
--cc=lukas@wunner.de \
--cc=matthias@kannwischer.eu \
--cc=mcgrof@kernel.org \
--cc=petr.pavlu@suse.com \
--cc=samitolvanen@google.com \
--cc=smueller@chronox.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).