Move to stronger (PQ) signing for APK repos

For Developers
1

Theoretical cost estimations to break ECC have decreased sufficiently, such that, at a minimum, signing APK repos with ECDSA P-256 is soon insufficient i.e. within the next two years (otherwise MITM/PITM or supply-chain attacks become 'practical'). ECDSA shall now be regarded as a legacy algo, but bumping keys to P-521 is an acceptable short-term change.

Edit: signed package lists are a decent protection against this, but present signing keys are within reach of brute forcing.

ML-DSA (Dilithium) and FN-DSA (Falcon) are suitable signing choices. ML-DSA shows orders of magnitude faster signing and verification speeds than ECDSA P-521.

1 Like
2

On the same note and arguably as important would be having the ssh key exchange done with either mlkem or sntrup by default.

I know OpenSSH already supports PQ, unsure about dropbear or whether there are any plans for OpenWRT to switch.

ssh: Available ciphers: chacha20-poly1305@openssh.com,aes256-ctr,aes128-ctr
3

Yes. Anything which traverses a monitorable network is vulnerable to store now decrypt later. So passwords should be rotated more frequently. And ssh should not be used alone, but inside of a tunnel, e.g. WireGuard.

Cloudflare also got the memo:

1 Like
4

Dropbear has both mlken and sntrup, not sure if it is already enabled

5

Looks like both are enabled by default:

1 Like
6

@efahl Mlkem768 is missing from 25.12.2


root@OPNsense:~ # ssh -oKexAlgorithms=mlkem768x25519-sha256 openwrt
Unable to negotiate with 192.168.11.111 port 22: no matching key exchange method found. Their offer: sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,kexguess2@matt.ucc.asn.au,kex-strict-s-v00@openssh.com
1 Like
7

Right, the comments are misleading and the default is actually not set. Here's I see that when I generate a default config (make defconfig), it shows just the SNTRUP code is enabled (this is on a !SMALL_FLASH device).

$ grep -E 'SNTRUP|MLKEM' .config
# CONFIG_DROPBEAR_MLKEM768 is not set
CONFIG_DROPBEAR_SNTRUP761=y

Someone should check the code size bump and if it's reasonable, PR a change to add it...

1 Like