This series is targeting libcrypto-next.  It can also be retrieved from:

    git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git mldsa-v1

This series adds support for verifying ML-DSA signatures to lib/crypto/.
Patch 1 is the ML-DSA implementation itself.  See that for full details.

Patches 2-4 are the KUnit tests, which still need some more work.

Sending this out now as requested by David.  I'd like some more time to
work on writing proper tests and making sure that everything is correct.

This is just the lib/crypto/ part.  On top of this, we'll want to make
public_key_verify_signature() call mldsa_verify() to support ML-DSA.
(No need for the redundant crypto_sig abstraction layer.)

David Howells (1):
  lib/crypto: tests: Add KUnit tests for ML-DSA

Eric Biggers (3):
  lib/crypto: Add ML-DSA verification support
  lib/crypto: tests: Add ML-DSA-65 test cases
  lib/crypto: tests: Add ML-DSA-87 test cases

 include/crypto/mldsa.h                        |   51 +
 lib/crypto/Kconfig                            |    7 +
 lib/crypto/Makefile                           |    5 +
 lib/crypto/mldsa.c                            |  566 ++
 lib/crypto/tests/Kconfig                      |   10 +
 lib/crypto/tests/Makefile                     |    1 +
 lib/crypto/tests/mldsa_kunit.c                |  124 +
 .../tests/mldsa_pure_rejection_vectors_44.h   |  489 ++
 .../tests/mldsa_pure_rejection_vectors_65.h   | 4702 ++++++++++++
 .../tests/mldsa_pure_rejection_vectors_87.h   | 6390 +++++++++++++++++
 10 files changed, 12345 insertions(+)
 create mode 100644 include/crypto/mldsa.h
 create mode 100644 lib/crypto/mldsa.c
 create mode 100644 lib/crypto/tests/mldsa_kunit.c
 create mode 100644 lib/crypto/tests/mldsa_pure_rejection_vectors_44.h
 create mode 100644 lib/crypto/tests/mldsa_pure_rejection_vectors_65.h
 create mode 100644 lib/crypto/tests/mldsa_pure_rejection_vectors_87.h


base-commit: 10a1140107e0b98bd67d37ae7af72989dd7df00b
-- 
2.51.2

Note that your emailed patches seem corrupt somehow, but I can fetch the git
branch.

David

On Thu, Nov 20, 2025 at 08:11:16AM +0000, David Howells wrote:
> Note that your emailed patches seem corrupt somehow, but I can fetch the git
> branch.

Works for me:

git checkout -d 10a1140107e0b98bd67d37ae7af72989dd7df00b
b4 am 20251120003653.335863-1-ebiggers@kernel.org
git am ./20251119_ebiggers_lib_crypto_ml_dsa_verification_support.mbx

10a1140107e0b98bd67d37ae7af72989dd7df00b is the base-commit listed in
the cover letter, via the --base option to 'git format-patch'.  It's the
current head of libcrypto-next and is also in linux-next.  Maybe you
tried applying the series to a different commit.

Anyway, using the git repo is fine too.  This sort of stuff is exactly
why I usually provide a git link too.

- Eric