Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default #4305

randombit · 2024-08-13T22:23:57Z

Tested with cloudflare.com, google.com and ourselves.

This adjusts the default logic for both which groups to offer and which group to select during negotiation.

For offering, we send the first pure ECC group in the preference list. This avoids sending large PQ shares to servers that don't support them. If the client for whatever reason does not have any pure ECC groups, then we send a share of whatever their top preference is.

On the server side, if the client indicated support for any mutually supported PQ algorithm, we always select it, even if the client sent some other type of keyshare. Previously we would always prefer to select a group that the client sent a share of, to reduce round trips.

coveralls · 2024-08-13T22:52:43Z

coverage: 91.202% (-0.03%) from 91.23%
when pulling 19f3479 on jack/enable-pqc
into 960fdcf on master.

reneme

🚀 Nice! The PQ-era is here!

As a side note: This points at an open tech debt regarding the management of ciphersuites (also noted for a long time in #2990). As it is now, there's a lot of if {} else if {} else scattered around many places in the TLS implementation. Whenever algorithms are added, there's a lot of potential to miss something.

src/lib/tls/tls_policy.cpp

src/lib/tls/tls_session.cpp

src/tests/data/tls-policy/default.txt

src/tests/data/tls-policy/default_tls13.txt

src/tests/data/tls-policy/strict.txt

src/tests/data/tls-policy/strict_tls13.txt

src/lib/tls/tls_algos.cpp

randombit · 2024-08-15T11:23:28Z

Something is wrong - I know I tested that our client connecting to our server would negotiate Kyber (highly relevant since Botan being on both sides of the connection is very common) but now this doesn't work ....

randombit · 2024-08-15T11:33:37Z

Oh I see. I tested us<->us in my initial attempt which put Kyber at the absolute top of the preference list. However I realized later this caused us to send a large keyshare that is ignored much of the time, which is non-optimal.

But it seems - unlike the stacks in google.com and cloudflare.com - we will, if we receive a keyshare for say x25519, we won't ignore it even if the top preference of both the client and the server are Kyber - we just negotiate x25519. So we won't negotiate Kyber with ourselves 😭

randombit · 2024-08-15T11:41:21Z

OK I think we just need to adjust the logic in Policy::choose_key_exchange_group.

reneme · 2024-08-15T11:42:53Z

OK I think we just need to adjust the logic in Policy::choose_key_exchange_group.

... I was about to say that. Currently, the code there optimizes for round-trips and avoids sending a HelloRetryRequest whenever it can. I.e.: it will go for the non-PQ group if it is offered and fits with our supported groups.

randombit · 2024-08-15T11:51:30Z

I'll take a look at that BoringSSL and co do here. I expect it looks something like a 2-tier selection

If both peers share a PQC algorithm of any kind, then we're using PQC. If the client offered a PQC share, use that (even if it's not our favorite PQC). Otherwise choose a PQC, either clients favorite or servers favorite, depending on server_uses_own_ciphersuite_preferences.
If there is no mutually agreed upon PQC group, then use effectively the existing logic.

reneme · 2024-08-15T12:46:38Z

I expect it looks something like a 2-tier selection

Sounds reasonable to me as a default policy. I was thinking to propose an additional policy setting like prefer_pqc_groups_when_possible(). But then again: if one is explicitly offering PQC support at this time, I guess they are also fine with using it anyway.

randombit · 2024-08-15T12:53:25Z

prefer_pqc_groups_when_possible() might be worth having as an easy to use toggle for those who are willing to use PQC but would like to save the round trip where possible.

randombit · 2024-08-15T12:53:40Z

OTOH we already have a lot of fucking policy toggles 😅

reneme

BoGo isn't happy about our new cleverness in selecting KEX algos, I guess. Probably, we'll just have to override the policy with the old logic there.

src/lib/tls/tls_policy.cpp

src/lib/tls/tls_session.cpp

src/tests/unit_tls_policy.cpp

src/lib/tls/tls_session.h

src/lib/tls/tls_session.cpp

src/lib/tls/tls_policy.cpp

reneme

Let's not start offering Kyber by default anymore.

src/tests/data/tls-policy/default.txt

src/tests/data/tls-policy/strict.txt

src/lib/tls/tls_policy.cpp

src/lib/tls/tls_algos.h

randombit · 2024-12-20T21:03:32Z

@reneme just wanted to ping on this, ideally this PR and #4393 would both merge, and then I'll remove the r3 support.

reneme

Note that tls13_kex_to_string will need to be adapted when merged with #4393, due to the introduction of is_pure_ml_kem() in there. It's probably a good idea to merge that first and then rebase this PR onto it.

src/lib/tls/tls_session.cpp

src/tests/data/tls-policy/default.txt

src/tests/data/tls-policy/strict.txt

randombit · 2024-12-24T22:56:22Z

@reneme Rebased after merging #4393

reneme

I'd suggest to split Kyber and ML-KEM explicitly in tls_algos.h. Otherwise, this looks good to me. Thanks, and Merry Christmas! 🎄

src/lib/tls/tls_algos.cpp

src/lib/tls/tls_algos.h

src/lib/tls/tls_algos.cpp

src/lib/tls/tls_algos.h

This adjusts the default logic for both which groups to offer and which group to select during negotiation. For offering, we send the first pure ECC group in the preference list. This avoids sending large PQ shares to servers that don't support them. If the client for whatever reason does not have any pure ECC groups, then we send a share of whatever their top preference is. On the server side, if the client indicated support for any mutually supported PQ algorithm, we always select it, even if the client sent some other type of keyshare. Previously we would always prefer to select a group that the client sent a share of, to reduce round trips. This also rearranges the default list, and removes some of the most expensive FFDHE groups. Expose which group was used for key exchange in the Session_Summary, since otherwise there is no way to know if PQ exchange occurred or not. Co-authored-by: René Meusel <[email protected]>

randombit added this to the Botan 3.6.0 milestone Aug 13, 2024

randombit requested a review from reneme August 13, 2024 22:23

randombit force-pushed the jack/enable-pqc branch from 503d8df to ee8f6c0 Compare August 14, 2024 00:00

reneme approved these changes Aug 14, 2024

View reviewed changes

randombit requested a review from reneme August 15, 2024 11:36

reneme approved these changes Aug 15, 2024

View reviewed changes

randombit modified the milestones: Botan 3.6.0, Botan 3.7.0 Oct 7, 2024

reneme reviewed Oct 17, 2024

View reviewed changes

src/lib/tls/tls_policy.cpp Outdated Show resolved Hide resolved

reneme mentioned this pull request Oct 17, 2024

PQC: Add hybrid groups x25519/ML-KEM-768 and secp256r1/ML-KEM-768 #4375

Merged

randombit force-pushed the jack/enable-pqc branch from 18b58a2 to 83a05cc Compare October 24, 2024 09:00

randombit requested a review from reneme October 24, 2024 09:02

randombit force-pushed the jack/enable-pqc branch 3 times, most recently from ec0d301 to a354031 Compare October 24, 2024 09:29

randombit changed the title ~~Enable PQC ciphersuite in TLS 1.3 by default~~ Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default Oct 24, 2024

reneme requested changes Oct 24, 2024

View reviewed changes

src/tests/data/tls-policy/default.txt Outdated Show resolved Hide resolved

src/tests/data/tls-policy/strict.txt Outdated Show resolved Hide resolved

src/lib/tls/tls_policy.cpp Outdated Show resolved Hide resolved

src/lib/tls/tls_algos.h Outdated Show resolved Hide resolved

reneme mentioned this pull request Oct 24, 2024

Deprecate all Kyber r3 TLS ciphersuites with intent to remove in 3.7.0 #4407

Merged

randombit force-pushed the jack/enable-pqc branch 2 times, most recently from 7d241d6 to 9a1a4d8 Compare October 25, 2024 09:51

randombit force-pushed the jack/enable-pqc branch from 9a1a4d8 to 2ea7092 Compare November 1, 2024 11:34

randombit force-pushed the jack/enable-pqc branch from 2ea7092 to 5cd6c61 Compare December 11, 2024 16:22

randombit requested a review from reneme December 11, 2024 16:45

randombit force-pushed the jack/enable-pqc branch 3 times, most recently from 0956fe7 to f48192c Compare December 12, 2024 13:53

reneme approved these changes Dec 23, 2024

View reviewed changes

src/lib/tls/tls_session.cpp Outdated Show resolved Hide resolved

src/lib/tls/tls_session.cpp Outdated Show resolved Hide resolved

src/tests/data/tls-policy/default.txt Outdated Show resolved Hide resolved

src/tests/data/tls-policy/strict.txt Outdated Show resolved Hide resolved

reneme mentioned this pull request Dec 23, 2024

PQC: Add TLS 1.3 groups for (pure) ML-KEM-512, -768 and -1024 #4393

Merged

randombit force-pushed the jack/enable-pqc branch 2 times, most recently from 75f32bb to c5fbcba Compare December 24, 2024 22:55

reneme approved these changes Dec 25, 2024

View reviewed changes

src/lib/tls/tls_algos.cpp Show resolved Hide resolved

src/lib/tls/tls_algos.h Show resolved Hide resolved

src/lib/tls/tls_algos.cpp Show resolved Hide resolved

src/lib/tls/tls_algos.cpp Show resolved Hide resolved

src/lib/tls/tls_algos.h Outdated Show resolved Hide resolved

randombit force-pushed the jack/enable-pqc branch from d9ca4c6 to 19f3479 Compare December 27, 2024 13:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default #4305

Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default #4305

randombit commented Aug 13, 2024 •

edited

Loading

coveralls commented Aug 13, 2024 •

edited

Loading

reneme left a comment

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

reneme commented Aug 15, 2024 •

edited

Loading

randombit commented Aug 15, 2024

reneme commented Aug 15, 2024

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

reneme left a comment

reneme left a comment

randombit commented Dec 20, 2024

reneme left a comment

randombit commented Dec 24, 2024

reneme left a comment

Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default #4305

Are you sure you want to change the base?

Enable the post-quantum x25519+ML-KEM-768 TLS 1.3 ciphersuite by default #4305

Conversation

randombit commented Aug 13, 2024 • edited Loading

coveralls commented Aug 13, 2024 • edited Loading

reneme left a comment

Choose a reason for hiding this comment

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

reneme commented Aug 15, 2024 • edited Loading

randombit commented Aug 15, 2024

reneme commented Aug 15, 2024

randombit commented Aug 15, 2024

randombit commented Aug 15, 2024

reneme left a comment

Choose a reason for hiding this comment

reneme left a comment

Choose a reason for hiding this comment

randombit commented Dec 20, 2024

reneme left a comment

Choose a reason for hiding this comment

randombit commented Dec 24, 2024

reneme left a comment

Choose a reason for hiding this comment

randombit commented Aug 13, 2024 •

edited

Loading

coveralls commented Aug 13, 2024 •

edited

Loading

reneme commented Aug 15, 2024 •

edited

Loading