Secure Boot with support for FIPS 204 ML-DSA post-quantum signature algorithm
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Is your feature request related to a problem? Please describe.
Hi Photon OS team,
The FIPS 204 ML-DSA post-quantum signature algorithm seems to become the preferred one for future secure boot. The openssl 3.0 series' support will fade out next year and hybrid/composite pqc signature algorithms will be supported in 3.5++ only (https://github.com/openssl/openssl/issues/26121).
| Version | Release Type | Release Date | Supported Until |
|---|---|---|---|
| 3.0 | LTS | Sep 2021 | Sep 2026 |
| 3.5 | LTS | Apr 2025 | Apr 2030 |
3.0 to 3.5 is a remarkable change. Early impact testing for openssl 3.5 in Photon OS could be helpful.
Describe the solution you'd like
Verified as described in STIG compliances, in dod-compliance-and-automation
Describe alternatives you've considered
No response
Additional context
fyi
https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Photon OS's current secure-boot and OpenSSL 3.0 support, then assess the impact of OpenSSL 3.5 and FIPS 204 ML-DSA on the requested workflow. Compare the result with the linked STIG compliance expectations. Done means the required implementation scope and verification criteria are defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- cryptography, operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100