[nginx] PQC (Post-Quantum Cryptography)

Dobro jutro.

Evo, fantje in dekline, nov dan nov izziv.

Danes sem opazil, da Qualys SSL test testira PQC in če ne dela, vrne:

This server does not support PQC (Post-Quantum Cryptography) key exchange.

Po nekje eni uri googlanja, spreminjanja config fajla, testiranja... mi zadeve ni uspelo spravit da bi delala.

Tole je izsek config fajla v nginx:

# TODO
# post-quantum cryptography (pqc)
ssl_ecdh_curve secp384r1;
#ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
#ssl_conf_command Groups X25519MLKEM768:X25519:secp256r1:secp384r1;
#ssl_ecdh_curve auto;
#ssl_conf_command Groups X25519MLKEM768;

Takole se testira na client strani:

openssl s_client -groups "X25519MLKEM768" -tls1_3 -connect www.slo-tech.com:443

In output z errorjem ter praznim "TLS1.3 group":

Connecting to 91.236.1.130
CONNECTED(00000003)
4037E71AC87F0000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls
alert handshake failure:../ssl/record/rec_layer_s3.c:918:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 7 bytes and written 1427 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

Pa še en dokaj obširen link na to temo:

Prepare Your Servers: TLS 1.3 Must Evolve for the Post-Quantum Internet — ML-DSA and ML-KEM Are the New Standards

To je pa to zaenkrat.