Bug 2450393 - RFE: apply upstream patch to ignore channel_binding for ML-DSA
Summary: RFE: apply upstream patch to ignore channel_binding for ML-DSA
Keywords:
Status: CLOSED DUPLICATE of bug 2438170
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jan Macku
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-23 17:34 UTC by Rob Crittenden
Modified: 2026-03-30 07:45 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-03-30 07:45:32 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Fedora Package Sources curl pull-request 82 0 None None None 2026-03-30 06:34:53 UTC

Description Rob Crittenden 2026-03-23 17:34:53 UTC 
As originally reported upstream in https://github.com/curl/curl/issues/20590

The behavior of channel binding with ML-DSA is undefined in RFC 5299. In section 4.1:

   o  if the certificate's signatureAlgorithm uses no hash functions or
      uses multiple hash functions, then this channel binding type's
      channel bindings are undefined at this time (updates to is channel
      binding type may occur to address this issue if it ever arises).

Upstream curl merged a patch to not treat this in a way to lead to connection failure. See https://github.com/curl/curl/commit/b0f6e9a3d7be02e8f2e323aa97f2ff9b30662b32

The request is to backport this to at least rawhide, if not F45 as well. This will enable development of products that use PQC and curl.

Reproducible: Always

Steps to Reproduce:
I can go into details if you need them.
Comment 1 Jan Macku 2026-03-30 07:45:32 UTC 

*** This bug has been marked as a duplicate of bug 2438170 ***
Note You need to log in before you can comment on or make changes to this bug.