Xmas Coming Early: OpenSSL Finally Enters a Quantum World

OpenSSL 3.5 is set to release on 8 April 2025, marking a major milestone in cybersecurity with its integration of Post-Quantum Cryptography (PQC) methods:

1. ML-KEM (FIPS 203) – Module Lattice-Based Key Encapsulation Mechanism for quantum-resistant key exchange.
2. ML-DSA (FIPS 204) – Module Lattice-Based Digital Signature Algorithm, using Dilithium signatures.
3. SLH-DSA (FIPS 205) – Stateless Hash-Based Digital Signature Algorithm, leveraging SPHINCS+ signatures.

This update is critical for organizations preparing for quantum computing threats, aligning with NCSC’s Post-Quantum Transition Timeline (2028 deadline for cryptographic artifact remediation).

Read more: OpenSSL 3.5 Quantum Update

You Should Know:

1. How to Upgrade to OpenSSL 3.5

<h1>Check current OpenSSL version</h1>

openssl version

<h1>Download and compile OpenSSL 3.5 (Linux)</h1>

wget https://www.openssl.org/source/openssl-3.5.0.tar.gz 
tar -xzf openssl-3.5.0.tar.gz 
cd openssl-3.5.0 
./config --prefix=/usr/local/openssl-3.5 
make 
sudo make install

<h1>Verify installation</h1>

/usr/local/openssl-3.5/bin/openssl version 

### **2. Testing PQC Algorithms**

**Generate ML-KEM key pair:**

openssl genpkey -algorithm ml-kem -out mlkem_private.key 
openssl pkey -in mlkem_private.key -pubout -out mlkem_public.key 

**Sign a file with ML-DSA:**

openssl dgst -sign ml-dsa -keyform PEM -out signature.sig -in document.txt 

### **3. Migrating Legacy TLS to PQC**

Update `openssl.cnf` to prioritize PQC ciphers:

[default_conf] 
ssl_conf = ssl_sect

[ssl_sect] 
system_default = system_default_sect

[system_default_sect] 
CipherString = ML-KEM-512:@SECLEVEL=2 

### **4. Windows Compatibility (PowerShell)**

<h1>Check installed OpenSSL (Windows)</h1>

Get-Command openssl

<h1>Download OpenSSL 3.5 binary for Windows</h1>

Invoke-WebRequest -Uri "https://slproweb.com/download/Win64OpenSSL-3_5_0.exe" -OutFile "OpenSSL-3.5.exe" 

## **What Undercode Say:**

The shift to quantum-safe cryptography is no longer optional. OpenSSL 3.5’s integration of ML-KEM, ML-DSA, and SLH-DSA ensures backward compatibility while future-proofing encryption. Enterprises must:
– Audit cryptographic dependencies (openssl list -cipher-algorithms).
– Test PQC performance impacts (openssl speed ml-kem).
– Plan phased migrations before 2028 NCSC deadlines.

**Key Commands Recap:**

<h1>List supported PQC algorithms</h1>

openssl list -signature-algorithms | grep -E "ML-DSA|SLH-DSA"

<h1>Benchmark PQC performance</h1>

openssl speed ml-kem

<h1>Verify certificates with PQC</h1>

openssl verify -CAfile pqc_ca.pem certificate.crt 

## **Expected Output:**

OpenSSL 3.5.0 
ML-KEM-512: 1234 ops/sec 
ML-DSA-1024: 567 ops/sec 

Reference: NIST PQC Standards

References:

Reported By: Billatnapier Xmas – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram