Too many advertised sig algs cause TLS server hang-up #399
Labels
bug
Something isn't working
Comments
|
Oh, so I guess I must learn Rust, then? 😆 |
|
Actually, this could be much simpler than I anticipated. See the TLS Changes section in OpenSSL's migration guide or SSL_CTX_set_options(3) / SSL_set_options(3). |
|
I think I observe a similar issue, but easier to reproduce with just curl -v https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.30.x64.tar.gz.sigThis fails with Output with `oqsprovider` enabledOutput without `oqsprovider` enabled |
@levitte Of course! Didn't you know that all along? :-)
Unfortunately, neither do I. Code that I didn't write uses OpenSSL library that misbehaves when OQS provider is present/loaded. The best I see is the example from @iyanmv that reproduces the problem with What I observe with this reproducer is that TLS 1.3 Handshake begins with sending "Client Hello", and after that connection attempt fails, with server responding with "close notify" (not on timeout, as I thought?). What's in the "Client Hello" when OQS is loaded, that the server doesn't even bother to answer?
Unfortunately, the problem manifests itself with (popular and widely used) code that none of the participants here wrote or has any control over. If we had a reproducer, we could try adding that TLS option and see if it fixes the problem. As it is, I don't know... And why everything is OK with OQS provider is out of the picture (with all the other providers enabled)? Also, this problem appeared only this week. What changed, and where? (https://index.crates.io, OpenSSL, |
|
@iyanmv's curl example shows that this happens in the handshake. There is one thing that might, or might not be related to this: the OQS provider uses SIGALG capabilities to add signature algorithms to the set that libssl has built in. It's possible that this affects the TLS handshake in a way that causes this issue. |
|
I was writing this for something else, but I leave it here in case it's useful for anyone to reproduce the issue with my exact setup: podman run -it --rm archlinux:base-devel sh -c "$(cat <<EOF
# Update packages & install dependencies to build liboqs and oqs-provider
pacman -Syu --noconfirm &&
pacman -S --noconfirm \
cmake \
curl \
doxygen \
git \
ninja \
python \
python-jinja \
python-tabulate \
python-yaml
# Build liboqs & install
git clone https://aur.archlinux.org/liboqs.git
# chmod 777 directory because makepkg cannot run as root
chmod 777 liboqs && cd liboqs
runuser -unobody -- makepkg --nocheck
pacman -U --noconfirm liboqs-1\:0.10.0-2-x86_64.pkg.tar.zst
# Build oqs-provider & install
cd ..
git clone https://aur.archlinux.org/oqsprovider.git
# chmod 777 directory because makepkg cannot run as root
chmod 777 oqsprovider && cd oqsprovider
runuser -unobody -- makepkg --nocheck
pacman -U --noconfirm oqsprovider-0.6.0-1-x86_64.pkg.tar.zst
# Get openssl conf file from oqs-provider/scripts
cd ..
curl -O https://raw.githubusercontent.com/open-quantum-safe/oqs-provider/main/scripts/openssl-ca.cnf
# This works (oqsprovider is not enabled)
curl -v -o /dev/null https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.30.x64.tar.gz.sig
# This doesn't work (oqsprovider enabled)
export OPENSSL_CONF=/openssl-ca.cnf
curl -v -o /dev/null https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.30.x64.tar.gz.sig
EOF
)"But I was able to reproduce using the Since this only happens with certain servers, can it also be a "misconfiguration" on the server side? If the client offers PQC KEM, perhaps that triggers something on the server side that causes the handshake to fail. |
|
Checking the exchange with wireshark, it really looks like a server issue. It responds with a close notify message after the client hello. (Github doesn't like .pcapng, so renamed to .txt) |
|
This is the captured TLS 1.3 "Client Hello" with OQS provider enabled, which causes the server to shut up and not even respond with "Server Hello": And here's the exchange ("Client Hello" and "Server Hello") between the same entities, with OQS provider disabled (commented out in |
|
I suspected something like that. The server like, "yo'weeeird, I'm walking away" |
Is there any way to test/validate this hypothesis? And if it proves true - how can we work around this problem without completely disabling OQS provider? |
You could run s_client to connect to your server with a limited list of cipher suites, groups and sig algs? |
|
With OpenSSL-3.4.x-dev (master branch): With OpenSSL-3.2.1 (released/stable, Macports-installed): |
|
Another example:
|
|
Let me try to sum this all up:
|
|
It isn't clear to me if the servers that were tested against are using the oqsprovider or not. What I get out of that the outputs shown here is it may as well be that they respond in different (possibly faulty) ways when faced with cipher suites they do not know... but, TLS isn't my area of expertise, so I can't do much more than relay my impression |
|
I agree with @levitte. I don't think that the servers where I observe this issue support any PQ KEM. It's just that they fail to do the TLS handshake after the client offers PQ algs. They terminate rather than continue with a traditional KEM. Regarding this @baentsch
With the latest server I observed the issue, you can try to replicate the following echo Q | openssl s_client -connect fwupd.org:443 # It works
echo Q | openssl s_client -provider oqsprovider -connect fwupd.org:443 # It fails |
|
Oh, can it be that when |
|
Well, this error is simple: The second command (o)misses the default provider:
OK if run as such
|
(I didn't need to add the default manually because I have it enabled in the config file) But even adding |
|
|
Interesting. It worked for me both for the system --> What's your |
$ openssl -version
OpenSSL 3.2.1 30 Jan 2024 (Library: OpenSSL 3.2.1 30 Jan 2024) |
|
I want to bring to everybody's attention the fact that up until Apr 12th, OpenSSL and It could be the upgrade to OpenSSL-3.2.1, which was installed on my machine on Apr 9th - so, if |
Nope: Just built What clearly is visible is that the server runs TLS 1.2, so anyway all "(oqs)provider logic" should not trigger anyway.
Nope, too: This time period was the 0.6.0 "release hiatus". As you can reproduce this @iyanmv @mouse07410 , could you please take a close look at my 3.2.1 log and yours to spot differences? |
|
I did a |
|
And I can only reproduce if I enable all the algs in This is what I'm doing when generating the package for Arch: prepare() {
# Enable additional algorithms supported by liboqs
# See: https://github.com/open-quantum-safe/oqs-provider/issues/210
cd ${pkgname}
sed -i -e "s/enable: false/enable: true/g" oqs-template/generate.yml
# Some files are needed from the liboqs source code or generate.py will fail
LIBOQS_SRC_DIR="${srcdir}/liboqs-${_pkgverliboqs}" python oqs-template/generate.py
}So this is the # This is the master document for ID interoperability for KEM IDs, p-hybrid KEM IDs, SIG (O)IDs
# Next free plain KEM ID: 0x024A, p-hybrid: 0x2F4A, X-hybrid: 0x2FB6
kems:
-
family: 'FrodoKEM'
name_group: 'frodo640aes'
nid: '0x0200'
nid_hybrid: '0x2F00'
oqs_alg: 'OQS_KEM_alg_frodokem_640_aes'
extra_nids:
current:
- hybrid_group: "x25519"
nid: '0x2F80'
-
family: 'FrodoKEM'
name_group: 'frodo640shake'
nid: '0x0201'
nid_hybrid: '0x2F01'
oqs_alg: 'OQS_KEM_alg_frodokem_640_shake'
extra_nids:
current:
- hybrid_group: "x25519"
nid: '0x2F81'
-
family: 'FrodoKEM'
name_group: 'frodo976aes'
nid: '0x0202'
nid_hybrid: '0x2F02'
oqs_alg: 'OQS_KEM_alg_frodokem_976_aes'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2F82'
-
family: 'FrodoKEM'
name_group: 'frodo976shake'
nid: '0x0203'
nid_hybrid: '0x2F03'
oqs_alg: 'OQS_KEM_alg_frodokem_976_shake'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2F83'
-
family: 'FrodoKEM'
name_group: 'frodo1344aes'
nid: '0x0204'
nid_hybrid: '0x2F04'
oqs_alg: 'OQS_KEM_alg_frodokem_1344_aes'
-
family: 'FrodoKEM'
name_group: 'frodo1344shake'
nid: '0x0205'
nid_hybrid: '0x2F05'
oqs_alg: 'OQS_KEM_alg_frodokem_1344_shake'
-
family: 'BIKE'
name_group: 'bike1l1cpa'
bit_security: 128
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0206'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp256_r1
nid: '0x2F06'
oqs_alg: 'OQS_KEM_alg_bike1_l1_cpa'
-
family: 'BIKE'
name_group: 'bike1l3cpa'
bit_security: 192
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0207'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp384_r1
nid: '0x2F07'
oqs_alg: 'OQS_KEM_alg_bike1_l3_cpa'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber512'
nid: '0x023A'
oid: '1.3.6.1.4.1.22554.5.6.1'
nid_hybrid: '0x2F3A'
hybrid_oid: '1.3.6.1.4.1.22554.5.7.1'
oqs_alg: 'OQS_KEM_alg_kyber_512'
extra_nids:
current:
- hybrid_group: "x25519"
hybrid_oid: '1.3.6.1.4.1.22554.5.8.1'
nid: '0x2F39'
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x020F'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp256_r1
nid: '0x2F0F'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: x25519
nid: '0x2F26'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber768'
nid: '0x023C'
oid: '1.3.6.1.4.1.22554.5.6.2'
nid_hybrid: '0x2F3C'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2F90'
- hybrid_group: "x25519"
nid: '0x6399'
- hybrid_group: "p256"
nid: '0x639A'
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0210'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp384_r1
nid: '0x2F10'
oqs_alg: 'OQS_KEM_alg_kyber_768'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber1024'
nid: '0x023D'
oid: '1.3.6.1.4.1.22554.5.6.3'
nid_hybrid: '0x2F3D'
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0211'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp521_r1
nid: '0x2F11'
oqs_alg: 'OQS_KEM_alg_kyber_1024'
-
family: 'ML-KEM'
name_group: 'mlkem512'
nid: '0x0247'
oid: '1.3.6.1.4.1.22554.5.6.1'
nid_hybrid: '0x2F47'
hybrid_oid: '1.3.6.1.4.1.22554.5.7.1'
oqs_alg: 'OQS_KEM_alg_ml_kem_512'
extra_nids:
current:
- hybrid_group: "x25519"
hybrid_oid: '1.3.6.1.4.1.22554.5.8.1'
nid: '0x2FB2'
-
family: 'ML-KEM'
name_group: 'mlkem768'
nid: '0x0248'
oid: '1.3.6.1.4.1.22554.5.6.2'
nid_hybrid: '0x2F48'
oqs_alg: 'OQS_KEM_alg_ml_kem_768'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2FB3'
- hybrid_group: "x25519"
nid: '0x2FB4'
- hybrid_group: "p256"
nid: '0x2FB5'
-
family: 'ML-KEM'
name_group: 'mlkem1024'
nid: '0x0249'
oid: '1.3.6.1.4.1.22554.5.6.3'
nid_hybrid: '0x2F49'
oqs_alg: 'OQS_KEM_alg_ml_kem_1024'
-
family: 'BIKE'
name_group: 'bike1l1fo'
bit_security: 128
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0223'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp256_r1
nid: '0x2F23'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: "x25519"
nid: '0x2F28'
oqs_alg: 'OQS_KEM_alg_bike1_l1_fo'
-
family: 'BIKE'
name_group: 'bike1l3fo'
bit_security: 192
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0224'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp384_r1
nid: '0x2F24'
oqs_alg: 'OQS_KEM_alg_bike1_l3_fo'
-
family: 'BIKE'
name_group: 'bikel1'
implementation_version: '5.1'
nid: '0x0241'
nid_hybrid: '0x2F41'
oqs_alg: 'OQS_KEM_alg_bike_l1'
extra_nids:
current:
- hybrid_group: "x25519"
nid: '0x2FAE'
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x0238'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: x25519
nid: '0x2F37'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp256_r1
nid: '0x2F38'
-
family: 'BIKE'
name_group: 'bikel3'
implementation_version: '5.1'
nid: '0x0242'
nid_hybrid: '0x2F42'
oqs_alg: 'OQS_KEM_alg_bike_l3'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2FAF'
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x023B'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp384_r1
nid: '0x2F3B'
-
family: 'BIKE'
name_group: 'bikel5'
implementation_version: '5.1'
nid: '0x0243'
nid_hybrid: '0x2F43'
oqs_alg: 'OQS_KEM_alg_bike_l5'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber90s512'
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x0229'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp256_r1
nid: '0x2F29'
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x023E'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp256_r1
nid: '0x2F3E'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: x25519
nid: '0x2FA9'
oqs_alg: 'OQS_KEM_alg_kyber_512_90s'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber90s768'
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x022A'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp384_r1
nid: '0x2F2A'
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x023F'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp384_r1
nid: '0x2F3F'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: x448
nid: '0x2FAA'
oqs_alg: 'OQS_KEM_alg_kyber_768_90s'
-
family: 'CRYSTALS-Kyber'
name_group: 'kyber90s1024'
extra_nids:
old:
- implementation_version: NIST Round 2 submission
nist-round: 2
nid: '0x022B'
- implementation_version: NIST Round 2 submission
nist-round: 2
hybrid_group: secp521_r1
nid: '0x2F2B'
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x0240'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp521_r1
nid: '0x2F40'
oqs_alg: 'OQS_KEM_alg_kyber_1024_90s'
-
family: 'HQC'
name_group: 'hqc128'
nid: '0x0244'
nid_hybrid: '0x2F44'
oqs_alg: 'OQS_KEM_alg_hqc_128'
extra_nids:
current:
- hybrid_group: "x25519"
nid: '0x2FB0'
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x022C'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp256_r1
nid: '0x2F2C'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: x25519
nid: '0x2FAC'
-
family: 'HQC'
name_group: 'hqc192'
nid: '0x0245'
nid_hybrid: '0x2F45'
oqs_alg: 'OQS_KEM_alg_hqc_192'
extra_nids:
current:
- hybrid_group: "x448"
nid: '0x2FB1'
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x022D'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp384_r1
nid: '0x2F2D'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: x448
nid: '0x2FAD'
-
family: 'HQC'
name_group: 'hqc256'
nid: '0x0246'
nid_hybrid: '0x2F46'
oqs_alg: 'OQS_KEM_alg_hqc_256'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
nid: '0x022E'
- implementation_version: NIST Round 3 submission
nist-round: 3
hybrid_group: secp521_r1
nid: '0x2F2E'
kem_nid_end: '0x0250'
kem_nid_hybrid_end: '0x2FFF'
# need to edit ssl_local.h macros IS_OQS_KEM_CURVEID and IS_OQS_KEM_HYBRID_CURVEID with the above _end values
# Next free signature ID: 0xfed7
sigs:
# -
# iso (1)
# identified-organization (3)
# reserved (9999)
# oqs_sig_default (1)
# disabled
#variants:
# -
# name: 'oqs_sig_default'
# pretty_name: 'OQS Default Signature Algorithm'
# oqs_meth: 'OQS_SIG_alg_default'
# oid: '1.3.9999.1.1'
# code_point: '0xfe00'
# enable: true
# mix_with: [{'name': 'p256',
# 'pretty_name': 'ECDSA p256',
# 'oid': '1.3.9999.1.2',
# 'code_point': '0xfe01'},
# {'name': 'rsa3072',
# 'pretty_name': 'RSA3072',
# 'oid': '1.3.9999.1.3',
# 'code_point': '0xfe02'}]
-
# OID scheme for hybrid variants of Dilithium:
# iso (1)
# identified-organization (3)
# reserved (9999)
# dilithium (2)
# OID scheme for plain Dilithium:
# iso (1)
# identified-organization (3)
# dod (6)
# internet (1)
# private (4)
# enterprise (1)
# IBM (2)
# qsc (267)
# Dilithium-r3 (7)
family: 'CRYSTALS-Dilithium'
variants:
-
name: 'dilithium2'
pretty_name: 'Dilithium2'
oqs_meth: 'OQS_SIG_alg_dilithium_2'
oid: '1.3.6.1.4.1.2.267.7.4.4'
code_point: '0xfea0'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.2.7.1',
'code_point': '0xfea1'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.2.7.2',
'code_point': '0xfea2'}]
-
name: 'dilithium3'
pretty_name: 'Dilithium3'
oqs_meth: 'OQS_SIG_alg_dilithium_3'
oid: '1.3.6.1.4.1.2.267.7.6.5'
code_point: '0xfea3'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.2.7.3',
'code_point': '0xfea4'}]
-
name: 'dilithium5'
pretty_name: 'Dilithium5'
oqs_meth: 'OQS_SIG_alg_dilithium_5'
oid: '1.3.6.1.4.1.2.267.7.8.7'
code_point: '0xfea5'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.2.7.4',
'code_point': '0xfea6'}]
-
name: 'dilithium2_aes'
pretty_name: 'Dilithium2_AES'
oqs_meth: 'OQS_SIG_alg_dilithium_2_aes'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.6.1.4.1.2.267.11.4.4'
code_point: '0xfea7'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.2.11.1',
'code_point': '0xfea8'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.2.11.2',
'code_point': '0xfea9'}]
-
name: 'dilithium3_aes'
pretty_name: 'Dilithium3_AES'
oqs_meth: 'OQS_SIG_alg_dilithium_3_aes'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.6.1.4.1.2.267.11.6.5'
code_point: '0xfeaa'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.2.11.3',
'code_point': '0xfeab'}]
-
name: 'dilithium5_aes'
pretty_name: 'Dilithium5_AES'
oqs_meth: 'OQS_SIG_alg_dilithium_5_aes'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.6.1.4.1.2.267.11.8.7'
code_point: '0xfeac'
supported_encodings: ['draft-uni-qsckeys-dilithium-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.2.11.4',
'code_point': '0xfead'}]
-
family: 'ML-DSA'
variants:
-
name: 'mldsa44'
pretty_name: 'ML-DSA-44'
oqs_meth: 'OQS_SIG_alg_ml_dsa_44'
oid: '1.3.6.1.4.1.2.267.12.4.4'
code_point: '0xfed0'
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.7.1',
'code_point': '0xfed3'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.7.2',
'code_point': '0xfed4'}]
-
name: 'mldsa65'
pretty_name: 'ML-DSA-65'
oqs_meth: 'OQS_SIG_alg_ml_dsa_65'
oid: '1.3.6.1.4.1.2.267.12.6.5'
code_point: '0xfed1'
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.7.3',
'code_point': '0xfed5'}]
-
name: 'mldsa87'
pretty_name: 'ML-DSA-87'
oqs_meth: 'OQS_SIG_alg_ml_dsa_87'
oid: '1.3.6.1.4.1.2.267.12.8.7'
code_point: '0xfed2'
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.7.4',
'code_point': '0xfed6'}]
-
# iso (1)
# identified-organization (3)
# reserved (9999)
# falcon (3)
family: 'Falcon'
variants:
-
name: 'falcon512'
pretty_name: 'Falcon-512'
oqs_meth: 'OQS_SIG_alg_falcon_512'
oid: '1.3.9999.3.6'
code_point: '0xfeae'
supported_encodings: ['draft-uni-qsckeys-falcon-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.3.7',
'code_point': '0xfeaf'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.3.8',
'code_point': '0xfeb0'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.3.1'
code_point: '0xfe0b'
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.3.2',
'code_point': '0xfe0c'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.3.3',
'code_point': '0xfe0d'}]
-
name: 'falcon1024'
pretty_name: 'Falcon-1024'
oqs_meth: 'OQS_SIG_alg_falcon_1024'
oid: '1.3.9999.3.9'
code_point: '0xfeb1'
supported_encodings: ['draft-uni-qsckeys-falcon-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.3.10',
'code_point': '0xfeb2'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.3.4'
code_point: '0xfe0e'
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.3.5',
'code_point': '0xfe0f'}]
-
family: 'SPHINCS-Haraka'
variants:
-
name: 'sphincsharaka128frobust'
pretty_name: 'SPHINCS+-Haraka-128f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_128f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.1.1'
code_point: '0xfe42'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.1.2',
'code_point': '0xfe43'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.1.3',
'code_point': '0xfe44'}]
-
name: 'sphincsharaka128fsimple'
pretty_name: 'SPHINCS+-Haraka-128f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_128f_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.1.4'
code_point: '0xfe45'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.1.5',
'code_point': '0xfe46'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.1.6',
'code_point': '0xfe47'}]
-
name: 'sphincsharaka128srobust'
pretty_name: 'SPHINCS+-Haraka-128s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_128s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.1.7'
code_point: '0xfe48'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.1.8',
'code_point': '0xfe49'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.1.9',
'code_point': '0xfe4a'}]
-
name: 'sphincsharaka128ssimple'
pretty_name: 'SPHINCS+-Haraka-128s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_128s_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.1.10'
code_point: '0xfe4b'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.1.11',
'code_point': '0xfe4c'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.1.12',
'code_point': '0xfe4d'}]
-
name: 'sphincsharaka192frobust'
pretty_name: 'SPHINCS+-Haraka-192f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_192f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.2.1'
code_point: '0xfe4e'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.2.2',
'code_point': '0xfe4f'}]
-
name: 'sphincsharaka192fsimple'
pretty_name: 'SPHINCS+-Haraka-192f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_192f_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.2.3'
code_point: '0xfe50'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.2.4',
'code_point': '0xfe51'}]
-
name: 'sphincsharaka192srobust'
pretty_name: 'SPHINCS+-Haraka-192s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_192s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.2.5'
code_point: '0xfe52'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.2.6',
'code_point': '0xfe53'}]
-
name: 'sphincsharaka192ssimple'
pretty_name: 'SPHINCS+-Haraka-192s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_192s_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.2.7'
code_point: '0xfe54'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.2.8',
'code_point': '0xfe55'}]
-
name: 'sphincsharaka256frobust'
pretty_name: 'SPHINCS+-Haraka-256f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_256f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.3.1'
code_point: '0xfe56'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.3.2',
'code_point': '0xfe57'}]
-
name: 'sphincsharaka256fsimple'
pretty_name: 'SPHINCS+-Haraka-256f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_256f_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.3.3'
code_point: '0xfe58'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.3.4',
'code_point': '0xfe59'}]
-
name: 'sphincsharaka256srobust'
pretty_name: 'SPHINCS+-Haraka-256s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_256s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.3.5'
code_point: '0xfe5a'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.3.6',
'code_point': '0xfe5b'}]
-
name: 'sphincsharaka256ssimple'
pretty_name: 'SPHINCS+-Haraka-256s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_haraka_256s_simple'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.3.7'
code_point: '0xfe5c'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.3.8',
'code_point': '0xfe5d'}]
-
family: 'SPHINCS-SHA2'
variants:
-
name: 'sphincssha26128frobust'
pretty_name: 'SPHINCS+-SHA256-128f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_128f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.4.1'
code_point: '0xfe5e'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.2',
'code_point': '0xfe5f'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.3',
'code_point': '0xfe60'}]
-
name: 'sphincssha2128fsimple'
pretty_name: 'SPHINCS+-SHA2-128f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_128f_simple'
oid: '1.3.9999.6.4.13'
code_point: '0xfeb3'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.14',
'code_point': '0xfeb4'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.15',
'code_point': '0xfeb5'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.4.4'
code_point: '0xfe61'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.5',
'code_point': '0xfe62'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.6',
'code_point': '0xfe63'}]
-
name: 'sphincssha256128srobust'
pretty_name: 'SPHINCS+-SHA256-128s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_128s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.4.7'
code_point: '0xfe64'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.8',
'code_point': '0xfe65'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.9',
'code_point': '0xfe66'}]
-
name: 'sphincssha2128ssimple'
pretty_name: 'SPHINCS+-SHA2-128s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_128s_simple'
oid: '1.3.9999.6.4.16'
code_point: '0xfeb6'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.17',
'code_point': '0xfeb7'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.18',
'code_point': '0xfeb8'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.4.10'
code_point: '0xfe67'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.4.11',
'code_point': '0xfe68'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.4.12',
'code_point': '0xfe69'}]
-
name: 'sphincssha256192frobust'
pretty_name: 'SPHINCS+-SHA256-192f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_192f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.5.1'
code_point: '0xfe6a'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.2',
'code_point': '0xfe6b'}]
-
name: 'sphincssha2192fsimple'
pretty_name: 'SPHINCS+-SHA2-192f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_192f_simple'
oid: '1.3.9999.6.5.10'
code_point: '0xfeb9'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.11',
'code_point': '0xfeba'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.5.3'
code_point: '0xfe6c'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.4',
'code_point': '0xfe6d'}]
-
name: 'sphincssha256192srobust'
pretty_name: 'SPHINCS+-SHA256-192s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_192s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.5.5'
code_point: '0xfe6e'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.6',
'code_point': '0xfe6f'}]
-
name: 'sphincssha2192ssimple'
pretty_name: 'SPHINCS+-SHA2-192s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_192s_simple'
oid: '1.3.9999.6.5.12'
code_point: '0xfebb'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.13',
'code_point': '0xfebc'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.5.7'
code_point: '0xfe70'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.5.8',
'code_point': '0xfe71'}]
-
name: 'sphincssha256256frobust'
pretty_name: 'SPHINCS+-SHA256-256f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_256f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.6.1'
code_point: '0xfe72'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.2',
'code_point': '0xfe73'}]
-
name: 'sphincssha2256fsimple'
pretty_name: 'SPHINCS+-SHA2-256f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_256f_simple'
oid: '1.3.9999.6.6.10'
code_point: '0xfebd'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.11',
'code_point': '0xfebe'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.6.3'
code_point: '0xfe74'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.4',
'code_point': '0xfe75'}]
-
name: 'sphincssha256256srobust'
pretty_name: 'SPHINCS+-SHA256-256s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_sha256_256s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.6.5'
code_point: '0xfe76'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.6',
'code_point': '0xfe77'}]
-
name: 'sphincssha2256ssimple'
pretty_name: 'SPHINCS+-SHA2-256s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_sha2_256s_simple'
oid: '1.3.9999.6.6.12'
code_point: '0xfec0'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.13',
'code_point': '0xfec1'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.6.7'
code_point: '0xfe78'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.6.8',
'code_point': '0xfe79'}]
-
family: 'SPHINCS-SHAKE'
variants:
-
name: 'sphincsshake256128frobust'
pretty_name: 'SPHINCS+-SHAKE256-128f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_128f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.7.1'
code_point: '0xfe7a'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.2',
'code_point': '0xfe7b'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.3',
'code_point': '0xfe7c'}]
-
name: 'sphincsshake128fsimple'
pretty_name: 'SPHINCS+-SHAKE-128f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_128f_simple'
oid: '1.3.9999.6.7.13'
code_point: '0xfec2'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.14',
'code_point': '0xfec3'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.15',
'code_point': '0xfec4'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.7.4'
code_point: '0xfe7d'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.5',
'code_point': '0xfe7e'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.6',
'code_point': '0xfe7f'}]
-
name: 'sphincsshake256128srobust'
pretty_name: 'SPHINCS+-SHAKE256-128s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_128s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.7.7'
code_point: '0xfe80'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.8',
'code_point': '0xfe81'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.9',
'code_point': '0xfe82'}]
-
name: 'sphincsshake128ssimple'
pretty_name: 'SPHINCS+-SHAKE-128s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_128s_simple'
oid: '1.3.9999.6.7.16'
code_point: '0xfec5'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.17',
'code_point': '0xfec6'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.18',
'code_point': '0xfec7'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.7.10'
code_point: '0xfe83'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p256',
'pretty_name': 'ECDSA p256',
'oid': '1.3.9999.6.7.11',
'code_point': '0xfe84'},
{'name': 'rsa3072',
'pretty_name': 'RSA3072',
'oid': '1.3.9999.6.7.12',
'code_point': '0xfe85'}]
-
name: 'sphincsshake256192frobust'
pretty_name: 'SPHINCS+-SHAKE256-192f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_192f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.8.1'
code_point: '0xfe86'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.2',
'code_point': '0xfe87'}]
-
name: 'sphincsshake192fsimple'
pretty_name: 'SPHINCS+-SHAKE-192f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_192f_simple'
oid: '1.3.9999.6.8.10'
code_point: '0xfec8'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.11',
'code_point': '0xfec9'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.8.3'
code_point: '0xfe88'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.4',
'code_point': '0xfe89'}]
-
name: 'sphincsshake256192srobust'
pretty_name: 'SPHINCS+-SHAKE256-192s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_192s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.8.5'
code_point: '0xfe8a'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.6',
'code_point': '0xfe8b'}]
-
name: 'sphincsshake192ssimple'
pretty_name: 'SPHINCS+-SHAKE-192s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_192s_simple'
oid: '1.3.9999.6.8.12'
code_point: '0xfeca'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.13',
'code_point': '0xfecb'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.8.7'
code_point: '0xfe8c'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p384',
'pretty_name': 'ECDSA p384',
'oid': '1.3.9999.6.8.8',
'code_point': '0xfe8d'}]
-
name: 'sphincsshake256256frobust'
pretty_name: 'SPHINCS+-SHAKE256-256f-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_256f_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.9.1'
code_point: '0xfe8e'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.2',
'code_point': '0xfe8f'}]
-
name: 'sphincsshake256fsimple'
pretty_name: 'SPHINCS+-SHAKE-256f-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_256f_simple'
oid: '1.3.9999.6.9.10'
code_point: '0xfecc'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.11',
'code_point': '0xfecd'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.9.3'
code_point: '0xfe90'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.4',
'code_point': '0xfe91'}]
-
name: 'sphincsshake256256srobust'
pretty_name: 'SPHINCS+-SHAKE256-256s-robust'
oqs_meth: 'OQS_SIG_alg_sphincs_shake256_256s_robust'
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.9.5'
code_point: '0xfe92'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.6',
'code_point': '0xfe93'}]
-
name: 'sphincsshake256ssimple'
pretty_name: 'SPHINCS+-SHAKE-256s-simple'
oqs_meth: 'OQS_SIG_alg_sphincs_shake_256s_simple'
oid: '1.3.9999.6.9.12'
code_point: '0xfece'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
enable: true
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.13',
'code_point': '0xfecf'}]
extra_nids:
old:
- implementation_version: NIST Round 3 submission
nist-round: 3
oid: '1.3.9999.6.9.7'
code_point: '0xfe94'
supported_encodings: ['draft-uni-qsckeys-sphincsplus-00/sk-pk']
mix_with: [{'name': 'p521',
'pretty_name': 'ECDSA p521',
'oid': '1.3.9999.6.9.8',
'code_point': '0xfe95'}] |
|
Only now I saw the warning in the README file
So perhaps what I observe is just openssl/openssl#23624 ? I'm using a version where this was not fixed. I will be happy to report back when Arch updates to the new OpenSSL version. I don't know if it's exactly what @mouse07410 originally reported because he didn't mention changing the |
Ahh....
Well, yes, that's a very high likelihood: You could confirm if the same setting (with all algs enabled) works OK for you using |
|
I don't recall changing But I blew away my copy of the repo, re-cloned it a-fresh, and repeated the test - so I can be sure that So far, result is rather sad: the problem remains. Neither OpenSSL-3.4.0-dev, nor OpenSSL-3.2.1 were able to connect to https://index.crates.io:443 with When I disable |
However, the current How would it deal with algorithms from providers that are disabled at the moment (for whatever reason)? Which is why being able to specify for a provider what algorithms it should advertise to TLS, seems easier in the short term.
That merely means that the actual limit that was exceeded when 60+ algorithms from oqsprovider were added, was larger than 64. |
|
Before answering I kindly ask you to make your tone less personal.
It should be done by the same person who installed and activated the particular provider, right?
Let me disagree. |
|
Perhaps this section in the USAGE.md could be expanded a little bit to satisfy @mouse07410 with a warning about that some TLS servers may fail if too many sig algs are offered by the client and how to avoid the problem with a "safe" (short enough) selection of signature algorithms as an example (like in this comment but perhaps using the same Groups from https://github.com/open-quantum-safe/oqs-demos/blob/main/nginx/fulltest/Dockerfile#L25-L26). I think the main problem for @mouse07410 (please, correct me if I understood you wrong) is that, at the moment, some servers fail when oqsprovider is used with the default enabled sig algs and with the default OpenSSL config file. |
That's precisely the quick "fix" I also had in mind. I just wanted to experiment a bit with different settings to propose something tested/validated against these "bad" servers -- and maybe already add that into a recommended default "openssl.cnf" (can't be the test one as we then could not test all sigalgs in TLS any more). Anyone beating me to a PR along those lines very welcome :) |
Yes, of course. My apologies.
Of course. But first, somebody would have to add what you propose to the code that deals with this file, and I suspect it's more work than you're portraying. Second, and more importantly - it will require much more knowledge of the normal user of the "guts" of the OpenSSL than IMHO is reasonable to expect. For example, I have no clue what signature (or KEM, or whatever) algorithms OpenSSL supports through all of its providers, and even less so - what algorithms it exports via TLS. I don't think it's fair to expect a "normal" user - even if/when this
No. I don't need this warning - I need to know what exactly to put into And I asked (perhaps, in an impolite way) who is going to provide that text suitable for direct includion into
I'm pretty sure this "fix" will not work for me. Thankfully, there's |
Surely not. I tried to state that I'll give it a go but stupidly got lost doing that as my "Linux Foundation allergy" on other issues sapped all my energy. Getting too old. Sorry.
My idea was to add code to the |
|
OK, so here are the alternatives that I see:
Needless to say, I prefer (3), while currently using (1). I don't think (2) is sustainable in the long run, unless the community agrees to (a) add such support, and (b) maintain such strings. |
|
[2] is supported in OpenSSL so I strongly prefer this solution. Installing oqsprovider is not a common configuration and anyway implies changing the |
Are you saying that
Yes. But even an otherwise-ignorant user like yours-truly can add a few trivial lines to While listing all the acceptable signature algorithms, especially when you factor in the providers, is IMHO an insurmountable task - and the one that no one can expect normal users to perform. So, unless there are "cribs", aka - examples of complete parameter-strings that would preserve the current TLS behavior with the Classic algorithms and give "sub-strings" to append for adding algorithms from providers (probably, for every provider) - I'm strongly against the [2], because it is the best in theory but very much unusable in practice. |
|
https://openssl.org/docs/man3.2/man5/config.html, SSL Configuration It is here since 1.1.1 But I totally agree that the provider-specific examples of these commands are necessary |
Sorry, I must be dense today - but I did not find anything there that lists signatures algorithms that should be allowed/enabled for TLS. :-( |
|
Quoting:
|
|
@beldmit thanks, but I still don't understand. I cannot find field IMHO, yet another example of stuff not being ready for a "normal" user. Because if to accomplish even such a simple step one has to ask experts - it's not ready by my book. |
|
It's named SignatureAlgorithms. And yes, any documentation contribution to OpenSSL is welcome |
It makes sense that those who understand the subject contribute documentation. E.g., what would you expect me to contrbute - my questions to you? |
|
Sorry, let me disagree. I'm aware of the structure of the documentation and know where to look for it. If you find not obvious the entry point to the documentation, please let me know what you think to be a valid starting point to look. |
Oh sure! Where do I begin? :-) First, an obvious place for me to learn about the contents of the config file would be (unsurprisingly!) something like How's that for the beginning? ;-) |
|
So the
What's wrong here and could you please submit a PR to make it better? |
The mere fact that neither a list (let alone a complete list) of the keys and their allowed values is given, nor is the format (suitable for inclusion in As I also already said, it's impractical to expect a normal user to know those.
If I knew the answers to the above questions - I wouldn't bother asking people here and spending my time on this discussion. Instead, I would've just edited |
First step done in openssl/openssl#24499 @mouse07410 The list of default-active sigalgs is indeed documented in SSL_CONF_cmd(3), though not in a way that it can be written down immediately. Also, it's dependent on the activated providers (as clarified in the PR above just created) which is tedious but a consequence of the dynamic provider concept. @beldmit Are you aware of a facility within |
|
And another question if I may, @beldmit : Do you know where the semantics of "..." is documented as you used it in your "crypto_policy" example above? When "playing around" with a .cnf file now generated as part of an enhanced |
|
@baentsch In Fedora we ship oqsprovider/liboqs and have the corresponding PQ policy. Currently it provides all the algorithms supported by liboqs |
Thanks for letting me know, but my question pertains to
So does this mean you disable there all hybrid and composite algs, thus working around this issue by supporting fewer than 64 sigalgs? |
Which is one of my points - a user would have to figure out how to write them down in a proper form. I don't think such an expectation is reasonable.
Which is my other point - we can't get away from dynamic providers (nor do we want to), so the process becomes not merely tedious, but requiring an expert. I say again - this is a nice theoretic solution that has no room in the ugly practical world. |
I completely agree. Hence my question above
Now raised in openssl/openssl#24522 to get input from the openssl community. Also tagging @levitte @mattcaswell @romen fyi. |
|
So far, all this discussion strengthened my conviction that the only practical doable-now way is to allow every provider (starting with this one) to define a subset of all the algorithms it supports that it will offer/expose to TLS. |
|
Unfortunately no, see my comment openssl/openssl#24535 (comment) |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Provider built from the
mainbranch pulled after Fri Apr 12, 2024, somehow causes OpenSSL to hang and then time-out on requests over corporate firewall (to https://index.crates.io, in case it matters).When I comment out
oqsprovider inopenssl.cnfthe problem disappears.I must add that before Apr 12th everything worked just fine. So, it's OpenSSL, or liboqs, or oqs-provider.
@levitte could you please take a look as well? I don't know whether it's the provider's fault, or that of the OpenSSL itself.
To Reproduce
A little complicated, but here's what I have.
Steps to reproduce the behavior:
cargo-updateviacargo install cargo-updateliboqs.oqs-provider(mainbranch).openssl.cnfto addoqsprovider (some add it asoqsprovider, for me naming itoqssuffices).cargo install-update -lExpected behavior
Something like
Actual behavior
Environment (please complete the following information):
mainis)Please run the following commands to obtain the version information:
openssl versionopenssl list -providersThe text was updated successfully, but these errors were encountered: