The integrity subsystem changes merged last week for the Linux 7.2 kernel include support now for IMA and EVM post-quantum
Linux's Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) for verifying file and system integrity now is able to validate using post-quantum ML-DSA signatures for better security. ML-DSA is a modern replacement to the likes of RSA and ECC. This addition allows for more future-proof integrity of Linux systems around signatures, kernel modules, and certificates for file verification being safe against quantum attacks of the future.
The integrity pull for Linux 7.2 also introduces support to be able to remove IMA measurement list records stored in kernel memory. Due to the measurement list growing linearly and to now always keeping it in kernel memory, it's becoming an issue for resource-constrained systems. With Linux 7.2 it's possible to stage to now provide staged deletion with confirmation and staged deletion of N number of records without needing confirmation.
More details on these integrity improvements in Linux 7.2 for those interested via
ML-DSAsignature support.Linux's Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) for verifying file and system integrity now is able to validate using post-quantum ML-DSA signatures for better security. ML-DSA is a modern replacement to the likes of RSA and ECC. This addition allows for more future-proof integrity of Linux systems around signatures, kernel modules, and certificates for file verification being safe against quantum attacks of the future.
The integrity pull for Linux 7.2 also introduces support to be able to remove IMA measurement list records stored in kernel memory. Due to the measurement list growing linearly and to now always keeping it in kernel memory, it's becoming an issue for resource-constrained systems. With Linux 7.2 it's possible to stage to now provide staged deletion with confirmation and staged deletion of N number of records without needing confirmation.
More details on these integrity improvements in Linux 7.2 for those interested via