CachyOS / CachyOS/linux-cachyos

MODULE_SIG_KEY_TYPE_RSA vs MODULE_SIG_KEY_TYPE_ECDSA

Open
#745 0 comments 0 reactions 3 assignees Claimed by @ventureoo View on GitHub
enhancement
Dominant language
Shell
Stars
4.5k
Forks
160
Avg merge
2d 12h
Merged PRs (30d)
1

Description

### Pre-flight checklist

- [x] I have searched existing issues/PRs and this has not been requested before.
- [x] I have read the [Contributing Guidelines](https://github.com/CachyOS/linux-cachyos/blob/master/CONTRIBUTING.md).

### Request type

- [ ] New patch / patchset inclusion
- [x] Kernel config change (enable/disable option)
- [ ] New kernel variant
- [ ] Scheduler tuning / addition
- [ ] Compiler / LTO / PGO optimization
- [ ] Security hardening
- [ ] Driver or hardware enablement
- [x] Other

### Summary

Currently, ECDSA is [enabled](https://github.com/CachyOS/linux-cachyos/blob/083a37759b3baaa77c52412d081ceb0e6f0b577c/linux-cachyos/config#L12040).

What was the motivation behind this choice?
For example, Fedora has chosen the RSA option there.

### Motivation / use case

Make the kernel compatible with [sbctl](https://github.com/Foxboron/sbctl), which does not support ECDSA.

### Patch / upstream reference (if available)

_No response_

### Testing / benchmarks

_No response_

### Additional context

That's mostly for discussion rather than feature request/config change.
For my use case, I have a Fedora 43 system with custom secure boot keys enrolled (via sbctl) + UKI. So no grub2/shim.
Goal: Load external modules (zfs/razer/etc).

And with the current config, it's just not possible, because the kernel accepts only ECDSA keys, while sbctl works only with RSA, and the firmware of the laptop/EFI also supports RSA (but didn't test ECDSA separately, though).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.