cron2 has uploaded a new patch set (#7) to the change originally created by comododragon. ( http://gerrit.openvpn.net/c/openvpn/+/1046?usp=email )
The following approvals got outdated and were removed: Code-Review+2 by plaisthos Change subject: Added PQE to WolfSSL ...................................................................... Added PQE to WolfSSL Change-Id: Ie0529c2074964b3be034f01e0ef53090a6edbd35 Signed-off-by: comododragon <rein.vanbaa...@fox-it.com> Acked-by: Arne Schwabe <arne-open...@rfc2549.org> Message-Id: <20250707133447.12404-1-g...@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32043.html Signed-off-by: Gert Doering <g...@greenie.muc.de> --- M README.wolfssl M src/openvpn/ssl_openssl.c 2 files changed, 31 insertions(+), 1 deletion(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/46/1046/7 diff --git a/README.wolfssl b/README.wolfssl index a5dfe31..3918d0f 100644 --- a/README.wolfssl +++ b/README.wolfssl @@ -28,3 +28,33 @@ * blowfish support (BF-CBC), you must use something like cipher AES-128-CBC to avoid trying to use BF-CBC * Windows CryptoAPI support + +************************************************************************* +To build WolfSSL with post-quantum KEMs built in, the following command is used: + +./configure --enable-openvpn --enable-kyber=all --enable-curve25519 + +WolfSSL supports the following post-quantum KEMs and post-quantum hybrid KEMs which must be specified +using the tls-groups option in an OpenVPN config. Unlike OpenSSL, which includes X25519MLKEM768 +in the default config, WolfSSL requires explicit configuration of tls-groups to include +at least one post-quantum KEM. + +ML_KEM_512 +ML_KEM_768 +ML_KEM_1024 + +P256_ML_KEM_512 +X25519_ML_KEM_512 + +P384_ML_KEM_768 +P256_ML_KEM_768 +X448_ML_KEM_768 +X25519_ML_KEM_768 + +P384_ML_KEM_1024 +P521_ML_KEM_1024 + +The naming conventions of algorithms differ between WolfSSL and OpenSSL. An example is that +OpenSSL omits underscores for their naming notation whereas WolfSSL expects them. Additionally, +OpenSSL does not accept the P curve notation and instead uses the equivalent secp notation. +A specific example is that WolfSSL expects P384_ML_KEM_1024, while OpenSSL expects secp384r1MLKEM1024. diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 2fc77d8..4c11cd4 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -560,7 +560,7 @@ tls_ctx_set_tls_groups(struct tls_root_ctx *ctx, const char *groups) { ASSERT(ctx); -#if OPENSSL_VERSION_NUMBER < 0x30000000L +#if OPENSSL_VERSION_NUMBER < 0x30000000L && !defined(ENABLE_CRYPTO_WOLFSSL) struct gc_arena gc = gc_new(); /* This method could be as easy as * SSL_CTX_set1_groups_list(ctx->ctx, groups) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1046?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie0529c2074964b3be034f01e0ef53090a6edbd35 Gerrit-Change-Number: 1046 Gerrit-PatchSet: 7 Gerrit-Owner: comododragon <rein.vanbaa...@fox-it.com> Gerrit-Reviewer: cron2 <g...@greenie.muc.de> Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com> Gerrit-Reviewer: plaisthos <arne-open...@rfc2549.org> Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net> Gerrit-MessageType: newpatchset
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
