Does Linkerd plan to support ML-DSA (Dilithium) for identity certificates? #15110
Unanswered
IonTibirna
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Linkerd 2.19's PQ key exchange (X25519MLKEM768) works great verified on our cluster.
However, identity certificates still use ECDSA P-256. We need full PQ mTLS both key exchange and signatures.
Is ML-DSA (FIPS 204) support for the identity service and proxy on the roadmap? aws-lc already supports ML-DSA, and RFC 9881 defines the X.509 algorithm identifiers.
Any guidance appreciated.
All reactions