From 86cdb0bc3d8c7bfe5f709246683a63d00f667e41 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Fri, 10 Jul 2026 13:39:42 +0200
Subject: [PATCH] Add support for ML-DSA-44 keys (#39747)

---
 app/lib/activitypub/linked_data_signature.rb | 2 +-
 app/lib/multibase.rb                         | 3 ++-
 app/lib/signed_request.rb                    | 2 +-
 app/models/keypair.rb                        | 3 ++-
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/app/lib/activitypub/linked_data_signature.rb b/app/lib/activitypub/linked_data_signature.rb
index c659d318a1f..4152e5826f1 100644
--- a/app/lib/activitypub/linked_data_signature.rb
+++ b/app/lib/activitypub/linked_data_signature.rb
@@ -33,7 +33,7 @@ class ActivityPub::LinkedDataSignature
     to_be_verified = options_hash + document_hash
 
     keypair.actor if keypair.keypair.public_key.verify(OpenSSL::Digest.new('SHA256'), Base64.decode64(signature), to_be_verified)
-  rescue OpenSSL::PKey::RSAError
+  rescue OpenSSL::PKey::PKeyError
     false
   end
 
diff --git a/app/lib/multibase.rb b/app/lib/multibase.rb
index 9b6b20aba10..5bb8831c3ae 100644
--- a/app/lib/multibase.rb
+++ b/app/lib/multibase.rb
@@ -7,6 +7,7 @@ class Multibase
   MULTICODEC_PREFIXES = {
     'rsa-pub': 0x1205,
     'ed25519-pub': 0xED,
+    'mldsa-44-pub': 0x1210,
   }.transform_values do |code|
     bytes = []
 
@@ -66,7 +67,7 @@ class Multibase
     else
       raise Error, 'Unsupported key type'
     end
-  rescue OpenSSL::PKey::RSAError => e
+  rescue OpenSSL::PKey::PKeyError => e
     raise Error, e
   end
 end
diff --git a/app/lib/signed_request.rb b/app/lib/signed_request.rb
index 58b5bd791c3..5b6bc7eb707 100644
--- a/app/lib/signed_request.rb
+++ b/app/lib/signed_request.rb
@@ -101,7 +101,7 @@ class SignedRequest
 
     def verify_signature(keypair, signature, compare_signed_string)
       true if keypair.keypair.public_key.verify(OpenSSL::Digest.new('SHA256'), signature, compare_signed_string)
-    rescue OpenSSL::PKey::RSAError
+    rescue OpenSSL::PKey::PKeyError
       nil
     end
 
diff --git a/app/models/keypair.rb b/app/models/keypair.rb
index 41fa74a0b32..f3ab49637ab 100644
--- a/app/models/keypair.rb
+++ b/app/models/keypair.rb
@@ -29,6 +29,7 @@ class Keypair < ApplicationRecord
   enum :type, {
     rsa: 0,
     ed25519: 1,
+    'ml-dsa-44': 2,
   }, validate: true
 
   validates :uri, presence: true, uniqueness: true, if: -> { account.remote? }
@@ -57,7 +58,7 @@ class Keypair < ApplicationRecord
       case type
       when 'rsa'
         OpenSSL::PKey::RSA.new(private_key || public_key)
-      when 'ed25519'
+      when 'ed25519', 'ml-dsa-44'
         OpenSSL::PKey.read(private_key || public_key)
       end
     end