Skip to content

Add ML-DSA-65 support #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
RankoR wants to merge 3 commits into
base: 17
Choose a base branch
from
+22 −11
Draft

Add ML-DSA-65 support #118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0659b49
encrypt-keys/decrypt-keys: handle all AVB keys
RankoR Aug 22, 2026
3f52a25
generate-keys: generate ML-DSA-65 AVB key
RankoR Aug 22, 2026
984e6b0
use ML-DSA-65 for Pixel 11 vbmeta signing
RankoR Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions decrypt-keys
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,14 @@ for key in ${signing_keys[@]}; do
fi
done

if [[ -f avb.pem ]]; then
for key in avb.pem avb_mldsa.pem; do
[[ -f $key ]] || continue
if [[ -n $password ]]; then
openssl pkcs8 -topk8 -in avb.pem -passin env:password -out "$tmp/avb.pem" -nocrypt
openssl pkcs8 -topk8 -in $key -passin env:password -out "$tmp/$key" -nocrypt
else
openssl pkcs8 -topk8 -in avb.pem -out "$tmp/avb.pem" -nocrypt
openssl pkcs8 -topk8 -in $key -out "$tmp/$key" -nocrypt
fi
fi
done

unset password

Expand Down
9 changes: 5 additions & 4 deletions encrypt-keys
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,14 @@ for key in ${signing_keys[@]}; do
fi
done

if [[ -f avb.pem ]]; then
for key in avb.pem avb_mldsa.pem; do
[[ -f $key ]] || continue
if [[ -n $password ]]; then
openssl pkcs8 -topk8 -in avb.pem -passin env:password -out "$tmp/avb.pem" -passout env:new_password -scrypt
openssl pkcs8 -topk8 -in $key -passin env:password -out "$tmp/$key" -passout env:new_password -scrypt
else
openssl pkcs8 -topk8 -in avb.pem -out "$tmp/avb.pem" -passout env:new_password -scrypt
openssl pkcs8 -topk8 -in $key -out "$tmp/$key" -passout env:new_password -scrypt
fi
fi
done

unset password
unset new_password
Expand Down
2 changes: 2 additions & 0 deletions generate-keys
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,7 @@ for device in ${devices[@]}; do
done
openssl genrsa 4096 | openssl pkcs8 -topk8 -scrypt -out avb.pem
../../external/avb/avbtool.py extract_public_key --key avb.pem --output avb_pkmd.bin
openssl genpkey -algorithm ML-DSA-65 | openssl pkcs8 -topk8 -scrypt -out avb_mldsa.pem
../../external/avb/avbtool.py extract_public_key --key avb_mldsa.pem --output avb_mldsa_pkmd.bin
cd ../..
done
13 changes: 10 additions & 3 deletions generate-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,10 +70,17 @@ else
user_error "$DEVICE is not supported by the release script"
fi

AVB_PKMD="$KEY_DIR/avb_pkmd.bin"
AVB_ALGORITHM=SHA256_RSA4096
if [[ $DEVICE == @(grizzly|cubs|kodiak|yogi) ]]; then
AVB_KEY="$KEY_DIR/avb_mldsa.pem"
AVB_PKMD="$KEY_DIR/avb_mldsa_pkmd.bin"
AVB_ALGORITHM=MLDSA65
else
AVB_KEY="$KEY_DIR/avb.pem"
AVB_PKMD="$KEY_DIR/avb_pkmd.bin"
AVB_ALGORITHM=SHA256_RSA4096
fi

sign_target_files_apks -o -d "$KEY_DIR" --avb_vbmeta_key "$KEY_DIR/avb.pem" --avb_vbmeta_algorithm $AVB_ALGORITHM \
sign_target_files_apks -o -d "$KEY_DIR" --avb_vbmeta_key "$AVB_KEY" --avb_vbmeta_algorithm $AVB_ALGORITHM \
--extra_apks com.android.adbd.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.adbd.apex="$KEY_DIR/avb.pem" \
--extra_apks AdServicesApk.apk="$KEY_DIR/releasekey" \
Expand Down