CachyOS / CachyOS/linux-cachyos
MODULE_SIG_KEY_TYPE_RSA vs MODULE_SIG_KEY_TYPE_ECDSA
- Dominant language
- Shell
- Stars
- 4.5k
- Forks
- 160
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 1
Description
### Pre-flight checklist
- [x] I have searched existing issues/PRs and this has not been requested before.
- [x] I have read the [Contributing Guidelines](https://github.com/CachyOS/linux-cachyos/blob/master/CONTRIBUTING.md).
### Request type
- [ ] New patch / patchset inclusion
- [x] Kernel config change (enable/disable option)
- [ ] New kernel variant
- [ ] Scheduler tuning / addition
- [ ] Compiler / LTO / PGO optimization
- [ ] Security hardening
- [ ] Driver or hardware enablement
- [x] Other
### Summary
Currently, ECDSA is [enabled](https://github.com/CachyOS/linux-cachyos/blob/083a37759b3baaa77c52412d081ceb0e6f0b577c/linux-cachyos/config#L12040).
What was the motivation behind this choice?
For example, Fedora has chosen the RSA option there.
### Motivation / use case
Make the kernel compatible with [sbctl](https://github.com/Foxboron/sbctl), which does not support ECDSA.
### Patch / upstream reference (if available)
_No response_
### Testing / benchmarks
_No response_
### Additional context
That's mostly for discussion rather than feature request/config change.
For my use case, I have a Fedora 43 system with custom secure boot keys enrolled (via sbctl) + UKI. So no grub2/shim.
Goal: Load external modules (zfs/razer/etc).
And with the current config, it's just not possible, because the kernel accepts only ECDSA keys, while sbctl works only with RSA, and the firmware of the laptop/EFI also supports RSA (but didn't test ECDSA separately, though).
Contributor guide
Assessment
This issue has not been assessed yet.