MODULE m5 · 8.0 HOURS

Integration of OQS and oqs-provider

0% complete

LEARNING OBJECTIVES

Module objectives

  1. Understand the Open Quantum Safe (OQS) architecture and the role of oqs-provider.
  2. Understand how PQ (Post-Quantum) algorithms are integrated into TLS 1.3.
  3. Configure and verify a hybrid TLS handshake in a local environment.
  4. Consider the impact of KEM implementation optimization (e.g., AVX-512) on actual handshake performance.

Theory of OQS and oqs-provider Integration

To protect existing data transmissions from the threat of quantum computers, it is essential to integrate NIST-standard-based post-quantum algorithms (PQC) into existing protocols like TLS 1.3. The OQS (Open Quantum Safe) project provides major frameworks to accelerate this integration [S2].

1. liboqs and oqs-provider

  • liboqs: The core library containing C-language implementations of PQC algorithms (ML-KEM, ML-DSA, etc.). It provides a unified API for various algorithms.
  • oqs-provider: An intermediate layer that utilizes the OpenSSL 3 provider structure to help OpenSSL applications (e.g., s_client, s_server) natively use PQC algorithms in liboqs. This allows testing PQC features in existing TLS tools without modification.

2. PQ Integration Method for TLS 1.3

During the TLS 1.3 handshake process, PQC KEM replaces or supplements existing key exchanges (e.g., ECDH).

  • PQ-only mode: Exchanges keys using only PQC KEM.
  • Hybrid mode: Combines existing classical algorithms (ECDH) with PQC algorithms. This is a transitional strategy that secures post-quantum safety while maintaining classical security guarantees, protecting against potential PQC library implementation errors or future vulnerabilities.

3. Performance Considerations

PQC KEM can have larger key sizes or higher computational loads than existing algorithms, directly impacting handshake performance [S2]. Utilizing latest hardware instruction sets (e.g., AVX-512) to optimize polynomial multiplication and modular reduction can increase handshake speeds [S2].

WORKED EXAMPLES

Worked examples

  1. Example 1: To verify that oqs-provider is loaded in OpenSSL, run the `openssl list -providers` command. The output must include the 'oqs' provider.
  2. Example 2: When performing a hybrid handshake, specify the key exchange group via command arguments, e.g., `openssl s_client -groups kyber768_x25519...`. This is a hybrid group that combines ML-KEM (Kyber) and classical Curve25519.

LAB PROTOCOL

Hybrid TLS Testing in Local Environment

  1. 1

    Build and install liboqs and oqs-provider within an isolated Docker container.

  2. 2

    Modify the OpenSSL configuration file (`openssl.cnf`) to activate the oqs provider.

  3. 3

    Open two terminals and run `openssl s_server` in one and `openssl s_client` in the other in hybrid mode.

  4. 4

    Use Wireshark to capture and analyze how the shared key group (Key Share) is transmitted in the ClientHello packet.

  5. 5

    Check handshake success and session encryption algorithm information.

Safety check
  • Experiments must be performed only within an isolated local virtual environment.
  • Never use certificates or keys used for operational services.
  • Be careful not to include actual service traffic when capturing with Wireshark.

Lab deliverables

  • Screenshot confirming activation of oqs-provider.
  • Hybrid handshake log file.
  • Analysis report of shared key group in Wireshark captured packets.

ASSIGNMENT

Migration Analysis Report Based on Cryptographic Agility

Deliverables

Rubric

  • Success of OQS toolchain build and execution.
  • Did you accurately describe hybrid mode operation through TLS packet analysis?
  • Is performance measurement data inclusive of experimental environment and version information and reproducible?
  • Is the migration roadmap logically authored based on the concept of cryptographic agility?

KNOWLEDGE CHECK

Knowledge check

1What is the core role of oqs-provider in OpenSSL?
2What is the primary reason for using 'hybrid mode' key exchange in TLS 1.3?

FIELD CHECK

Completion criteria

  • Completion of building a local test environment based on oqs-provider.
  • Completion of hybrid TLS handshake and packet capture verification.
  • Completion of report including experimental results and analysis.
  • Completion of Post-Quantum Migration Roadmap.

MODULE SOURCES

Module sources

  1. Faster Post-Quantum TLS 1.3 Based on ML-KEM: Implementation ...arxiv.org · paper