BSI Project 481

[securitykernel]

German Federal Office for Information Security (BSI) commissions a project "Maintenance and further development of the cryptographic library Botan". In can be regarded as a successor to the concluded BSI project 197 "Development of a secure crypto library".

Aim of this issue is to make activities from BSI project 481 transparent to Botan maintainers and users.

Project Organization

BSI Project 481 is a development project commissioned by the German Federal Office of Information Security (BSI).

• Contracting Authority: German Federal Office of Information Security (BSI)
• Contractor: Rohde & Schwarz Cybersecurity GmbH
• Subcontractor: Fraunhofer Institute for Applied and Integrated Security (AISEC)
• Project duration: 01/2022 – 12/2024 03/2025

Main Activities

Updating and maintaining the cryptographic library Botan

The BSI development branch shall be updated to the current Botan version (main development branch) in alignment with the BSI.

Extending Botan with PQC algorithms

The implementation of Botan shall be extended by post-quantum cryptographic algorithms (based on NIST, IETF and TR-02102-1). BSI is in charge of selecting the particular algorithms. The candidates selected are FrodoKEM, Classic McEliece, CRYSTALS-Kyber, CRYSTALS-Dilithium, XMSS, LMS and Sphincs+.

• Implement SPHINCS+ #3099
• Implement LMS #3105
• Implement FrodoKEM #3106
• Implement Classic McEliece #3107

Implement the final FIPS standards

• PQC: ML-KEM #3893
• PQC: ML-DSA #4270
• PQC: SLH-DSA #4291

Extending Botan with TLS 1.3 hybrid key agreement

A hybrid key agreement procedure in the TLS 1.3 stack shall be implemented (based on the TLS minimal standards of IETF and BSI).

• [TLS 1.3] Hybrid PQ/T key establishment #3609
• PQC: Add hybrid groups x25519/ML-KEM-768 and secp256r1/ML-KEM-768 #4375

Cryptographic documentation

The implemented algorithms shall be checked thoroughly as recommended by BSI. The documentation of the library shall be revised correspondingly, mainly cryptographic documentation.

• https://github.com/sehlen-bsi/botan-docs

[securitykernel]

The work package Extending Botan with PQC algorithms was slightly rescheduled. I updated all scheduled implementation dates in the linked issues.

[securitykernel]

With rescheduling of the work package Extending Botan with PQC algorithms, the project's duration was extended by 3 months, which I updated in the original description now.

[reneme]

We plan that the upcoming Botan 3.7.x release will be the last in scope of this BSI-funded project. With Classic McEliece (#3883) merged, all major mile stones of the project have been reached and are now upstream. 🥳