Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-112697

allow PQ algorithms in all rpm-sequoia crypto-policies (RHEL-9)

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: Generate New Ti...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • crypto-policies-20250905-1.git377cc42.el9_7
    • No
    • Moderate
    • 1
    • rhel-security-crypto-spades
    • 30
    • 0.5
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto25September
    • Approved Exception
    • Hide

      AC) MLKEM/MLDSA algorithms are allowed in all rpm-sequoia policies

      Show
      AC) MLKEM/MLDSA algorithms are allowed in all rpm-sequoia policies
    • Requested
    • Enabled
    • Automated
    • Known Issue
    • Hide
      .PQC for `rpm-sequoia` is always enabled in `crypto-policies`

      In RHEL 10.1, the `rpm-sequoia` fails to verify dual-signed RPM packages if one of the algorithms used for signing is disabled in system-wide cryptographic policies. This problem is common on systems that have post-quantum (PQ) algorithms disabled and cannot install packages signed with both classic and PQ cryptography.

      To prevent breaking the system, the enablement of PQ algorithms for `rpm-sequoia` is hardcoded on the `crypto-policies` level. As a result, PQ algorithms for `rpm-sequoia` are enabled regardless of any settings in `crypto-policies`.
      Show
      .PQC for `rpm-sequoia` is always enabled in `crypto-policies` In RHEL 10.1, the `rpm-sequoia` fails to verify dual-signed RPM packages if one of the algorithms used for signing is disabled in system-wide cryptographic policies. This problem is common on systems that have post-quantum (PQ) algorithms disabled and cannot install packages signed with both classic and PQ cryptography. To prevent breaking the system, the enablement of PQ algorithms for `rpm-sequoia` is hardcoded on the `crypto-policies` level. As a result, PQ algorithms for `rpm-sequoia` are enabled regardless of any settings in `crypto-policies`.
    • Done
    • Done
    • Unspecified
    • Unspecified
    • None

      With current behaviour of RHEL-9.7 pqrpm, verification of dual-signed RPM packages fails if some of the algorithms is disabled in crypto-policies.

      To prevent breaking the system, we need to enable PQ algorithms in all rpm-sequoia crypto policies before the proper fix is introduced (see the epic for high level plan).

              asosedki@redhat.com Alexander Sosedkin
              szidek@redhat.com Stanislav Zidek
              Alexander Sosedkin Alexander Sosedkin
              Ondrej Moris Ondrej Moris
              Mirek Jahoda Mirek Jahoda
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: