Enabling KEM and QSIGNATURE of choice in PQCrypto-VPN about pqcrypto-vpn HOT 2 CLOSED

Your edit is correct in that you want to chose a particular KEX, and OQS used OQSKEX as a standard prefix to distinguish their ciphersuites from the ones in mainline OpenSSL. In this case they are key exchange (KEX) algorithms, not key encapsulation methods (KEMs), so the nomenclature is correct in this case. But more importantly, those strings are coming from OQS-OpenSSL and are beyond our ability to control.

Be advised that we discovered, after our release, that most Picnic certificates don't actually work because they're too large. They worked early in our testing when they were trivial, but when we started adding more fields to the certificate we found they ended up exceeded a hardcoded limit somewhere inside OpenSSL. Since protecting the data in transit from future quantum attackers is the more interesting scenario right now instead of protecting the authentication against a quantum-enabled adversary, we're leaving this for now and focusing on getting the next release ready, and recommending people still use RSA or ECDSA certificates for authentication until then. See #6 for more information.

from pqcrypto-vpn.

Closing due to no further activity in a week; feel free to reopen if you have more questions on this.

from pqcrypto-vpn.