Loading...

Linking RHIVOS CVEs to...

Migration: Automation ...

SWIFT: POC Conversion

Sync from "Extern...

XML

Word

Printable

Acceptance Criteria:

Hide

AC1) ML-DSA-87, ML-DSA-65 and ML-DSA-44 are enabled in all gnutls policies we ship with the highest priority, under both secure-sig and secure-sig-for-cert

Show
AC1) ML-DSA-87, ML-DSA-65 and ML-DSA-44 are enabled in all gnutls policies we ship with the highest priority, under both secure-sig and secure-sig-for-cert
Preliminary Testing:
Pass
Errata Link:
https://errata.engineering.redhat.com/advisory/148296
Gating Tests:

Enabled
Test Coverage:

Automated

Release Note Type:
Feature
Release Note Text:

Hide
Feature, enhancement: crypto-policies gains support for enabling ML-DSA in gnutls config
Reason: gnutls gained support for ML-DSA in TLS
Result: ML-DSA is enabled in gnutls by default. `sign` values `MLDSA44`, `MLDSA65` and `MLDSA88` can be used to disable it back

Show
Feature, enhancement: crypto-policies gains support for enabling ML-DSA in gnutls config Reason: gnutls gained support for ML-DSA in TLS Result: ML-DSA is enabled in gnutls by default. `sign` values `MLDSA44`, `MLDSA65` and `MLDSA88` can be used to disable it back
Release Note Status:
Proposed
ProdDocsReview-CCS:
Unspecified
ProdDocsReview-Dev:
Unspecified
ProdDocsReview-QE:
Unspecified

GnuTLS now supports ML-DSA in TLS (RHEL-64740).

The algorithms ML-DSA-44, ML-DSA-65, and ML-DSA-87 should be enabled in all policies (DEFAULT, FIPS, etc.)

is duplicated by

RHEL-100754 MLDSA87 isn't marked as _SECURE in gnutls.config

is related to

RHEL-107471 GNUTLS complains that ML-DSA signatures can be forged

links to

RHBA-2025:148296 crypto-policies bug fix and enhancement update