Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 2. Verifying RPM packages with post-quantum signatures

To safeguard RHEL system integrity against future quantum computing attacks, install and verify RPM packages with post-quantum signatures. By utilizing these quantum-resistant algorithms, you ensure long-term software authenticity and prevent future forgery.

2.1. Enabling post-quantum RPM signatures verification
Link kopieren

To fortify the RHEL operating system against future quantum computing threats, enable the verification of RPM packages by using quantum-resistant algorithms. This configuration ensures the system can authenticate the integrity and origin of software signed with post-quantum cryptography.

In earlier Red Hat Enterprise Linux (RHEL) releases, the RPM utility verified only RPMv4 signatures. In RHEL 9.7 and later RHEL 9 versions, you can enable support for RPMv6 signatures by installing the multisig DNF plugin. The system then uses this plugin to verify post-quantum signatures transparently during the installation process. For verification to succeed, you must ensure the system trusts all required OpenPGP certificates.

One package can include multiple RPMv6 signatures, but only one RPMv4 signature. For example, RHEL RPM packages include the following signatures:

  • RSA and hybrid ML-DSA-87-Ed448 RPMv6 signatures
  • RSA RPMv4 signature

The redhat-release package also already includes all OpenPGP certificates required for verification of RHEL RPM signatures: 

$ rpm -ql redhat-release
 
...
/etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
...

Note that starting with RHEL 10.1, RPM provides native support for RPMv6 signatures. If a package contains an RPMv6 signature, the system verifies it automatically and ignores any legacy RPMv4 signatures. No additional configuration or plugins are required for this process.

Important

Always import or reference all OpenPGP certificates, including both classical keys, such as RSA, and post-quantum keys, such as ML-DSA. This hybrid verification enhances security: if one cryptographic algorithm or key is compromised, the system remains protected by the other.

If you distribute your own RPM packages with post-quantum signatures, establish trust for all OpenPGP certificates required to verify the signatures. Also, keep the post-quantum certificates and classical certificates in separate files.

Prerequisites

  • RHEL 9.7 or later is installed and fully updated.

Procedure

  1. Install the dnf-plugin-multisig package. This package also installs the pqrpm package, which is separate from default system RPM tools and uses its own database of trusted OpenPGP certificates. 

    # dnf install dnf-plugin-multisig

  2. To establish trust for Red Hat OpenPGP certificates, complete one of the following steps:

    • Add the certificates into the DNF repository configuration file. Use the gpgkey directive in the /etc/yum.repos.d/<repo_name>.repo file and list both certificate files: 

      gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
       file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release

      Indentation of the gpgkey values matters.

      Note that if you use this option, the system displays an additional interactive prompt during the package installation from the CLI unless you use the dnf command with the --assumeyes or -y option.

    • Import both certificates into the pqrpm database: 

      # /usr/lib/pqrpm/bin/rpmkeys --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release

      Use this alternative when the first option is not available, for example, when the DNF repository configuration file is managed externally and you cannot easily edit it.

Verification

  1. Install or update an RPM package, for example: 

    # dnf install gnupg2

  2. Check that the DNF plugin successfully verified all signatures during your last package installation or update: 

    # grep "Multisig:" /var/log/dnf.log
     
    2026-03-11T13:44:51+0100 DEBUG Multisig: verifying: /var/cache/dnf/rhel-9.8.0-baseos-f47b1846dcc4d7f2/packages/gnupg2-2.3.3-5.el9_7.x86_64.rpm
2026-03-11T13:44:52+0100 DEBUG Multisig: verification result: All signatures for gnupg2-2.3.3-5.el9_7.x86_64.rpm successfully verified (code=0)

    If you need to check the list of specific signatures that were verified, see Next steps.

  3. Verify that the OpenPGP certificates are imported into the pqrpm database: 

    $ /usr/lib/pqrpm/bin/rpmkeys -l
     
    fd431d51-4ae0493b: Red Hat, Inc. (release key 2) <security@redhat.com> public key
5a6340b3-6229229e: Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key
05707a62-68e6a1f3: Red Hat, Inc. (release key 4) <security@redhat.com> public key

    Note that if you added the certificates into the DNF repository configuration file, they are imported only after a successful package installation.

Next steps

2.2. Verifying RHEL RPM packages with post-quantum signatures
Link kopieren

To protect RHEL against future quantum attacks that can break standard keys, verify RPM packages signed with post-quantum cryptography. This ensures the integrity and authenticity of software updates throughout the system’s lifecycle.

Prerequisites

Procedure

  1. Download the RPM package that you want to verify into the current directory: 

    $ dnf download <package_name>

  2. Verify the signatures of the RPM file and list results of all the checks: 

    $ /usr/lib/pqrpm/bin/rpmkeys -Kv <package_file_name.rpm>
     
    Header V6 ML-DSA-87+Ed448/SHA512 Signature, key ID 05707a62: OK
Header V4 RSA/SHA256 Signature, key ID fd431d51: OK
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
MD5 digest: OK
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red HatNach oben