Listen to this Post
OpenSSL 3.5.0 has introduced support for three post-quantum cryptographic algorithms: ML-KEM, ML-DSA, and SLH-DSA, marking a significant step toward securing communications against quantum computing threats. These algorithms, standardized by NIST in August 2023, are designed to replace current cryptographic methods vulnerable to quantum attacks.
Understanding the Algorithms
1. ML-KEM (Module Lattice-Based Key Encapsulation Mechanism)
- Used for secure key exchange, generating a shared 32-byte secret.
- Comparable to current key exchange methods in TLS/SSH.
2. ML-DSA (Module Lattice-Based Digital Signature Algorithm)
- A post-quantum digital signature scheme for authentication.
3. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)
- Optimized for resource-constrained embedded systems.
You Should Know: Practical Implementation
1. Testing Post-Quantum Cryptography in OpenSSL 3.5.0
To experiment with these new algorithms, ensure you have OpenSSL 3.5.0 installed:
Check OpenSSL version openssl version Generate an ML-KEM key pair openssl genpkey -algorithm ml-kem -out mlkem_private.key openssl pkey -in mlkem_private.key -pubout -out mlkem_public.key Sign a file using ML-DSA openssl dgst -sign ml-dsa -keyform PEM -out signature.sig -in document.txt
2. Integrating Post-Quantum TLS
While full TLS integration is still in development, you can test experimental builds:
Example: Enabling post-quantum key exchange in a test server openssl s_server -cert server.crt -key server.key -www -cipher ML-KEM
3. Embedded Systems & SLH-DSA
For embedded developers, SLH-DSA offers a lightweight alternative:
Cross-compile OpenSSL with SLH-DSA support for ARM ./Configure linux-armv4 -no-shared -no-asm --with-post-quantum=slh-dsa make
What Undercode Say
The shift to post-quantum cryptography is inevitable. While widespread adoption may take years, early testing and integration are crucial for future-proofing systems. Below are additional commands to explore:
- Linux:
Check if OpenSSL supports post-quantum algorithms openssl list -public-key-algorithms | grep -i "ml|slh" Benchmark ML-KEM performance openssl speed ml-kem
-
Windows (PowerShell):
Verify OpenSSL installation Get-Command openssl Generate a self-signed cert with ML-DSA openssl req -x509 -newkey ml-dsa -keyout key.pem -out cert.pem -days 365 -nodes
Expected Output:
A secure, quantum-resistant cryptographic framework ready for future integration.
Reference:
References:
Reported By: Mrybczynska Have – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
