Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 2. Verifying RPM packages with post-quantum signatures

To safeguard RHEL system integrity against future quantum computing attacks, install and verify RPM packages with post-quantum signatures. By utilizing these quantum-resistant algorithms, you ensure long-term software authenticity and prevent future forgery.

2.1. Enabling post-quantum RPM signatures verification
Copiar o link

To fortify the RHEL operating system against future quantum computing threats, enable the verification of RPM packages by using quantum-resistant algorithms. This configuration ensures the system can authenticate the integrity and origin of software signed with post-quantum cryptography.

In earlier Red Hat Enterprise Linux (RHEL) releases, the RPM utility verified only RPMv4 signatures. In RHEL 9.7 and later RHEL 9 versions, you can enable support for RPMv6 signatures by installing the multisig DNF plugin. The system then uses this plugin to verify post-quantum signatures transparently during the installation process. For verification to succeed, you must ensure the system trusts all required OpenPGP certificates.

One package can include multiple RPMv6 signatures, but only one RPMv4 signature. For example, RHEL RPM packages include the following signatures:

  • RSA and hybrid ML-DSA-87-Ed448 RPMv6 signatures
  • RSA RPMv4 signature

The redhat-release package also already includes all OpenPGP certificates required for verification of RHEL RPM signatures: 

$ rpm -ql redhat-release
 
...
/etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
...

Note that starting with RHEL 10.1, RPM provides native support for RPMv6 signatures. If a package contains an RPMv6 signature, the system verifies it automatically and ignores any legacy RPMv4 signatures. No additional configuration or plugins are required for this process.

Important

Always import or reference all OpenPGP certificates, including both classical keys, such as RSA, and post-quantum keys, such as ML-DSA. This hybrid verification enhances security: if one cryptographic algorithm or key is compromised, the system remains protected by the other.

If you distribute your own RPM packages with post-quantum signatures, establish trust for all OpenPGP certificates required to verify the signatures. Also, keep the post-quantum certificates and classical certificates in separate files.

Prerequisites

  • RHEL 9.7 or later is installed and fully updated.

Procedure

  1. Install the dnf-plugin-multisig package. This package also installs the pqrpm package, which is separate from default system RPM tools and uses its own database of trusted OpenPGP certificates. 

    # dnf install dnf-plugin-multisig

  2. To establish trust for Red Hat OpenPGP certificates, complete one of the following steps:

    • Add the certificates into the DNF repository configuration file. Use the gpgkey directive in the /etc/yum.repos.d/<repo_name>.repo file and list both certificate files: 

      gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
       file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release

      Indentation of the gpgkey values matters.

      Note that if you use this option, the system displays an additional interactive prompt during the package installation from the CLI unless you use the dnf command with the --assumeyes or -y option.

    • Import both certificates into the pqrpm database: 

      # /usr/lib/pqrpm/bin/rpmkeys --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/RPM-GPG-KEY-PQC-redhat-release

      Use this alternative when the first option is not available, for example, when the DNF repository configuration file is managed externally and you cannot easily edit it.

Verification

  1. Install or update an RPM package, for example: 

    # dnf install gnupg2

  2. Check that the DNF plugin successfully verified all signatures during your last package installation or update: 

    # grep "Multisig:" /var/log/dnf.log
     
    2026-03-11T13:44:51+0100 DEBUG Multisig: verifying: /var/cache/dnf/rhel-9.8.0-baseos-f47b1846dcc4d7f2/packages/gnupg2-2.3.3-5.el9_7.x86_64.rpm
2026-03-11T13:44:52+0100 DEBUG Multisig: verification result: All signatures for gnupg2-2.3.3-5.el9_7.x86_64.rpm successfully verified (code=0)

    If you need to check the list of specific signatures that were verified, see Next steps.

  3. Verify that the OpenPGP certificates are imported into the pqrpm database: 

    $ /usr/lib/pqrpm/bin/rpmkeys -l
     
    fd431d51-4ae0493b: Red Hat, Inc. (release key 2) <security@redhat.com> public key
5a6340b3-6229229e: Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key
05707a62-68e6a1f3: Red Hat, Inc. (release key 4) <security@redhat.com> public key

    Note that if you added the certificates into the DNF repository configuration file, they are imported only after a successful package installation.

Next steps

2.2. Verifying RHEL RPM packages with post-quantum signatures
Copiar o link

To protect RHEL against future quantum attacks that can break standard keys, verify RPM packages signed with post-quantum cryptography. This ensures the integrity and authenticity of software updates throughout the system’s lifecycle.

Prerequisites

Procedure

  1. Download the RPM package that you want to verify into the current directory: 

    $ dnf download <package_name>

  2. Verify the signatures of the RPM file and list results of all the checks: 

    $ /usr/lib/pqrpm/bin/rpmkeys -Kv <package_file_name.rpm>
     
    Header V6 ML-DSA-87+Ed448/SHA512 Signature, key ID 05707a62: OK
Header V4 RSA/SHA256 Signature, key ID fd431d51: OK
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
MD5 digest: OK
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2026 Red HatVoltar ao topo