open-quantum-safe / oqs-demos Goto Github PK

PARTIALLY SUPPORTED Instructions for enabling the use of quantum-safe cryptography in assorted software using the OQS suite. CONTRIBUTORS WANTED.

Home Page: https://openquantumsafe.org/

Dockerfile 46.79% Shell 30.98% Python 19.78% HTML 0.28% C 0.95% Scala 1.22%

post-quantum cryptography chromium curl httpd nginx tls

oqs-demos's People

Contributors

Stargazers

Watchers

oqs-demos's Issues

Using the oqs curl software to curl an OQS enabled NGINX server

Hi,
I have used the Dockerfile of the nginx oqs-demo here to manually setup an OQC enabled NGINX server without the use of docker. I have generated a dilithium2 signed server certificate and referrenced it in the nginx.conf file. The certificate can be successfully retrieved using the s_client of the OQC fork of OpenSSL, doing the following:
<OpenSSL DIR>/apps/openssl s_client -connect //https:my-domain.com -curves <ALG> .

However, when i use the curl program provided in your image, using the command:
docker run -it openquantumsafe/curl curl -k https://my-domain.com --curves kyber512
I get the error: curl: (35) error:101310B0:elliptic curve routines:pkey_oqs_digestverify:verification failed.
Why might this be the case?

Replace OID/NID spreadsheet reference with link to current markdown file

As per discussion in open-quantum-safe/openssl#311 the reference to the ID spreadsheet is stale and needs to be replaced once open-quantum-safe/openssl#311 or open-quantum-safe/openssl#313 have landed.

Set up a live PQ SSL test server

URL of wireshark's server for version 3.4.9 has changed

This issue is for the Wireshark demo:

While trying to use the Wireshark demo, I run the build.sh script only to find that the path on Wireshark's download server (at line 43) didn't find anything. The script declares ${WIRESHARK_VERSION}=3.4.9, so the correct URL should be the following:

https://2.na.dl.wireshark.org/src/all-versions/wireshark-${WIRESHARK_VERSION}.tar.xz

Probably Wireshark version 3.4.9 has moved from /src/ directory in the directory /src/all-versions/ in Wireshark's download server.

Unable to use the default password for the openssh demo with the container

The image seems to work well but somehow connecting using the instruction from openssh/USAGE.md with oqs user and password oqs.pw did not work. I connected as root, did passwd oqs then was able to connect with the changed password via ssh@localhost.

Create a Docker image for the chromium build.

Integrating with MQTT mosquitto

Hello,
I want to integrate this fork of OpenSSL into the MQTT broker mosquitto. I already compiled both, and it works fine with the classical ciphers, as expected. Now I would like to use one of the PQ KEM in the handshake process. The MQTT client APIs that use OpenSSL (Paho, mosquitto) only allow to specified the ciphers to use (e.g., ECDHE-ECDSA-AES128-SHA), but give no option for groups or curves, used in the example opnessl s_client given, and in other integrations (Chromium). Any suggestions of what can I do?

Thanks in advance.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on P256_KYBER90S512 for Chromium release 0.7

Visiting https://test.openquantumsafe.org:6007/ using https://github.com/open-quantum-safe/oqs-demos/releases/download/0.7.0/chromium-ubuntu-0.7.0.tgz gives a ERR_SSL_VERSION_OR_CIPHER_MISMATCH error. Same for https://test.openquantumsafe.org:6010/ with the assumption of using P256_NTRU_HPS2048509. Maybe the paragraph with "Therefore, only the following hybrid algorithms will work" could directly link to the right port with matching working (hybrid) algorithms?

Add QUIC support

Based on work by Igor Barshteyn create a demo integrating OQS crypto into QUIC in the form of 2 docker images:

server: quic-enabled nginx
client: msquic

The docker images shall support all plain and hybrid KEM and signature QSC algorithm combinations and run both in local docker networks as well as on cloud hosts permitting performance evaluation of all QSC algorithm (combinations).

Create a demo for OQS-libssh

Similar to our OpenSSH demo Docker images

JSON-ify test server input and output

Contain algorithm/port mapping
Warn about mapping to change
Use for outputting (performance) test results

Testing against OQS server

Hello OQS team,

I would like to test our crypto+TLS implementation of hybrid-PQ against a different implementation. I think, testing against test.openquantumsfe.org would be ideal (as it means 0 setup cost). The goal is to verify the code functionally and look for "unknown-unkonwns".
Is it OK to shoot TLS client hello's into ports 6007 (kyber512) and 6045 (ecdh/p256-kyber512) for a couple of days?

Issue With OQS-Chromium

Hello,

I've already contacted @baentsch regarding this issue, and it might be helpful to post it.

Here is the problem: we've created the following certificate chain:

Common Name	Summary	Public Key Algorithm	Signature Algorithm	Link
TestCA	Root Certificate	P-384	ecdsa-with-SHA384	view
Test TLS CA	Intermediate Certificate	dilithium2	ecdsa-with-SHA384	view
dilithium2.webhop.me	Leaf Certificate	dilithium2	dilithium2	view

The root certificate has been imported into Chromium successfully. The website https://dilithium2.webhop.me (IPv6 Only) supports frodo640aes:ntru_hps2048509:bikel1:hqc128:p256_lightsaber:p256_sikep434:p256_sidhp434 key exchange algorithms and is accessible (we checked with OQS-cURL).

What We Expect:
Since the root certificate has been installed and the verification of root certificate - intermediate certificate chain doesn't require any OQS-enabled library, the website should be accessible in Chromium.

What Actually Happened:
Chromium returned two errors:

[10842:10862:1231/225648.339848:ERROR:ssl_client_socket_impl.cc(959)] handshake failed; returned -1, SSL error code 1, net_error -113
[10842:10862:1231/225648.343227:ERROR:ssl_client_socket_impl.cc(959)] handshake failed; returned -1, SSL error code 1, net_error -207

We further found that Chromium failed to verify the root certificate - intermediate certificate chain, but it succeeded in verifying the intermediate certificate - leaf certificate chain.

We tried to add the intermediate certificate to Chromium; nonetheless, we got the same error as #92.

Any ideas why this happened?

p.s. Wish everyone a joyful New Year! ☺️

Create curl patch to explicitly enable 'curves'

Working around default algorithm list reduction & enabling same capabilities as in nginx and apache httpd.

sslv3 alert handshake failure

Hi
After running the last command of Nginx I am getting the following output. Please help.

C:\Users\openssl-OQS-OpenSSL_1_1_1-stable\nginx> docker exec oqs-nginx /opt/openssl/apps/openssl s_client -CAfile CA.crt -curves oqs_kem_default -connect localhost:4433
0:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
CONNECTED(00000003)

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 9909 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

On OQS-OpenSSL integrated with Peer-to-Peer protocols

I saw that the oqs-demos repo offers a number of integrations of OQS-OpenSSL with client-server style applications.
My question is if there is any (current or futurely planned) example of integration with an open source peer-to-peer protocol to evaluate how the post-quantum migration impacts other networking paradigms?

Enable POC oqs-envoy

Continuing the discussion from here

ERR_CERT_WEAK_KEY in Pre-built Chromium binary

I see a warning about a weak key: ERR_CERT_WEAK_KEY, when connecting to test servers.

It’s happening with all signature algorithms supported by OQS-enabled Chromium build 0.4.0, except ecdsap256 and rsa3072. The secure connection symbol is missing on server page.

Also the "subject public key" field in certificate details is empty.

Why does Chromium display that field incorrectly? What could be the problem and how to solve it?

How to change the default PQ KEX algorithm of OQS-chromium?

Hi,

I have followed the instructions within the oqs-demos repository to build an OQS-enabled chromium and an OQS-enabled httpd server.

I found out that due to the chromium currently doesn't support curves option like the command line, it will use the default algorithm when I issue a HTTP request to my httpd server from it.
So if I configure my server only support algorithm "kyber512", the chromium will return the error page as shown below.

I have read the implementation notes of the BoringSSL saying that the client can use the SSL_CTX_set1_curves_list call to override this. But I can't find any instructions about how to actually do this.

Is that possible can anyone provide some information or instructions about how to do this?

Kind regards,

Ray

will wrk or wrk2 (HTTP benchmarking tool) work for testing the OQS-NGINX server?

I would like to benchmark the performance of OQS enabled server. But it turns out the openssl s-time returns the performance of user secs which I assume it is mainly on the client side.
I wonder will the OQS-NGINX server supports wrk or wrk2.
Or is there any other benchmarking tools could be used to test the server?

Create a demo for python

Completing the discussion from here this issue is to suggest creating

documentation how to integrate liboqs and oqs-openssl into and use this functionality easily from within python
a ready-to run docker image (with separate build and run instructions) already encoding this documentation
a patch for upstream python to enable setting TLS1.3 groups via API calls (into SSL_CTX_set1_groups_list)
working on bringing this patch into upstream python ssl module

@LeShadow : As discussed, please feel free to amend and/or work on this.

Add OQS to libnss (enabling loading quantum safe certificate into Chromium)

Hello,

I am currently trying to use the quantum-safe Chromium (0.5.0) build as a client to connect to the OQS haproxy container using its default certificate generation settings (the default signature algorithm used is dilithium3 according to this page: https://github.com/open-quantum-safe/oqs-demos/tree/main/haproxy). I tried to load the CA certificate from the haproxy container into Chromium but got the following error:

I have verified that I am able to use Curl with this certificate for authentication to access the haproxy, so it is not an issue with the certificate.

It appears that I obtain this error when I try to install certificates that use quantum-safe digital signature algorithms. For example, making use of the OQS fork of OpenSSL contained within the Curl container, I run the following command with <SIG_ALGO> = dilithium2, dilithium3, RSA, and falcon512:

docker run -v pwd:/opt/tmp -it openquantumsafe/curl openssl req -x509 -new -newkey <SIG_ALGO> -keyout /opt/tmp/CA.key -out /opt/tmp/CA.crt -nodes -subj "/CN=oqstest CA" -days 365

The certificates that used dilithium2, dilithium3, and falcon512 failed to load, but the certificate that used RSA loaded just fine.

Any help is appreciated!

Here is the certificate that I grabbed from within the haproxy container:

Adding BoringSSL/curl?

Would it be an idea to create a BoringSSL-based curl image, too? This might make interop testing easier (ensuring matching curve config files, e.g.). I'd be happy to do that, probably building on the present curl version (using openssl to create certs if bssl doesn't have that). I'd give it a try using the new curl-dev image #29 . Side benefit: I'd learn a bit about using BoringSSL...

@xvzcf : Sensible? Useless? Any comment welcome.

Create a binary of Chromium

Depends on #45

'OQS_KEM_alg_hqc_128_1_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_128'?

My system

iMac 2010, Ubuntu LTS 18.04

What I tried

docker build -t oqs-curl .

What happened

building openssl fails

crypto/ec/oqs_meth.c: In function 'get_oqs_alg_name':
crypto/ec/oqs_meth.c:324:14: error: 'OQS_KEM_alg_hqc_128_1_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_128'?
  324 |       return OQS_KEM_alg_hqc_128_1_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_128
crypto/ec/oqs_meth.c:324:14: note: each undeclared identifier is reported only once for each function it appears in
crypto/ec/oqs_meth.c:327:14: error: 'OQS_KEM_alg_hqc_192_1_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_192'?
  327 |       return OQS_KEM_alg_hqc_192_1_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_192
crypto/ec/oqs_meth.c:330:14: error: 'OQS_KEM_alg_hqc_192_2_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_192'?
  330 |       return OQS_KEM_alg_hqc_192_2_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_192
gcc  -I. -Iinclude -fPIC -pthread -m64 -Ioqs/include -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/opt/oqssa/ssl\"" -DENGINESDIR="\"/opt/oqssa/lib/engines-1.1\"" -DNDEBUG -DOQS_DEFAULT_GROUPS=p384_kyber768:X25519:kyber768 -MMD -MF crypto/engine/eng_cnf.d.tmp -MT crypto/engine/eng_cnf.o -c -o crypto/engine/eng_cnf.o crypto/engine/eng_cnf.c
crypto/ec/oqs_meth.c:333:14: error: 'OQS_KEM_alg_hqc_256_1_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_256'?
  333 |       return OQS_KEM_alg_hqc_256_1_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_256
crypto/ec/oqs_meth.c:336:14: error: 'OQS_KEM_alg_hqc_256_2_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_256'?
  336 |       return OQS_KEM_alg_hqc_256_2_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_256
crypto/ec/oqs_meth.c:339:14: error: 'OQS_KEM_alg_hqc_256_3_cca2' undeclared (first use in this function); did you mean 'OQS_KEM_alg_hqc_256'?
  339 |       return OQS_KEM_alg_hqc_256_3_cca2;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_KEM_alg_hqc_256
make[1]: *** [Makefile:3174: crypto/ec/oqs_meth.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: Leaving directory '/opt/ossl-src'
make: *** [Makefile:174: all] Error 2
The command '/bin/sh -c LDFLAGS="-Wl,-rpath -Wl,${INSTALLDIR}/lib" ./config shared ${OPENSSL_BUILD_DEFINES} --prefix=${INSTALLDIR} &&     make ${MAKE_DEFINES} && make install;' returned a non-zero code: 2

Comments

Last week it worked without throwing this error. Hope that you can help me fix it.

Not able to run at step0 - $ ./build/install-build-deps.sh

Hello Team,

i am building chromium server inside docker with taking the image of ubuntu. I am able to do the handshake with boring SSL.
Now, i am at step 0 and not able to run the below command
$ ./build/install-build-deps.sh.
The install-build-deps.sh file is present in the build folder but on running it , it throws the error :invalid option.
please help how to run this shell script.

Size-optimize wireshark docker image

The wireshark container is way too large for sensible use (3.58G) and could need some "trimming down". Anyone using it for real, please upvote this issue for resolution :-)

Create SSH demo images

Issue with hybrid key exchange

I tried connecting to the Open Quantum Safe test server on Internet using Chrome browser and traditional curl without any modification for Quantum safe algorithms.

My assumption is that the chrome browser and traditional curl are Non-hybrid-aware clients and hence the Open Quantum Safe test server should establish a traditional, non-PQ, connection.

I cycled through all the ports of the Open Quantum Safe test server. But traditional curl could not connect to any of the ports.

Is my assumption about hybrid model wrong? Can traditional chrome and curl (clients unaware of PQ algos) not connect to Open Quantum Safe test server?

Niginx and Curl connectivity like TLS and CMS demo

Hello Team,

I have built the keys using curl and nginx but i am not able to shocase the demo in the same way i was able to do in the TLS and CMS demo.
Can you please provide the elaborated method to do the same.
Below are the result set , I have received in curl, nginx and httpd.
I am using Windows 10 and installed docker on top of it.

Curl :
$

s_server -cert /opt/test/server.crt -key /opt/test/server.key -curves kyber512 -www -tls1_3 -accept localhost:4433
Secure Renegotiation IS supported
Ciphers supported in s_server binary
TLSv1.3    :TLS_AES_256_GCM_SHA384    TLSv1.3    :TLS_CHACHA20_POLY1305_SHA256
TLSv1.3    :TLS_AES_128_GCM_SHA256    TLSv1.2    :ECDHE-ECDSA-AES256-GCM-SHA384
TLSv1.2    :ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2    :DHE-RSA-AES256-GCM-SHA384
TLSv1.2    :ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2    :ECDHE-RSA-CHACHA20-POLY1305
TLSv1.2    :DHE-RSA-CHACHA20-POLY1305 TLSv1.2    :ECDHE-ECDSA-AES128-GCM-SHA256
TLSv1.2    :ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2    :DHE-RSA-AES128-GCM-SHA256
TLSv1.2    :ECDHE-ECDSA-AES256-SHA384 TLSv1.2    :ECDHE-RSA-AES256-SHA384
TLSv1.2    :DHE-RSA-AES256-SHA256     TLSv1.2    :ECDHE-ECDSA-AES128-SHA256
TLSv1.2    :ECDHE-RSA-AES128-SHA256   TLSv1.2    :DHE-RSA-AES128-SHA256
TLSv1.0    :ECDHE-ECDSA-AES256-SHA    TLSv1.0    :ECDHE-RSA-AES256-SHA
SSLv3      :DHE-RSA-AES256-SHA        TLSv1.0    :ECDHE-ECDSA-AES128-SHA
TLSv1.0    :ECDHE-RSA-AES128-SHA      SSLv3      :DHE-RSA-AES128-SHA
TLSv1.2    :RSA-PSK-AES256-GCM-SHA384 TLSv1.2    :DHE-PSK-AES256-GCM-SHA384
TLSv1.2    :RSA-PSK-CHACHA20-POLY1305 TLSv1.2    :DHE-PSK-CHACHA20-POLY1305
TLSv1.2    :ECDHE-PSK-CHACHA20-POLY1305 TLSv1.2    :AES256-GCM-SHA384
TLSv1.2    :PSK-AES256-GCM-SHA384     TLSv1.2    :PSK-CHACHA20-POLY1305
TLSv1.2    :RSA-PSK-AES128-GCM-SHA256 TLSv1.2    :DHE-PSK-AES128-GCM-SHA256
TLSv1.2    :AES128-GCM-SHA256         TLSv1.2    :PSK-AES128-GCM-SHA256
TLSv1.2    :AES256-SHA256             TLSv1.2    :AES128-SHA256
TLSv1.0    :ECDHE-PSK-AES256-CBC-SHA384 TLSv1.0    :ECDHE-PSK-AES256-CBC-SHA
SSLv3      :SRP-RSA-AES-256-CBC-SHA   SSLv3      :SRP-AES-256-CBC-SHA
TLSv1.0    :RSA-PSK-AES256-CBC-SHA384 TLSv1.0    :DHE-PSK-AES256-CBC-SHA384
SSLv3      :RSA-PSK-AES256-CBC-SHA    SSLv3      :DHE-PSK-AES256-CBC-SHA
SSLv3      :AES256-SHA                TLSv1.0    :PSK-AES256-CBC-SHA384
SSLv3      :PSK-AES256-CBC-SHA        TLSv1.0    :ECDHE-PSK-AES128-CBC-SHA256
TLSv1.0    :ECDHE-PSK-AES128-CBC-SHA  SSLv3      :SRP-RSA-AES-128-CBC-SHA
SSLv3      :SRP-AES-128-CBC-SHA       TLSv1.0    :RSA-PSK-AES128-CBC-SHA256
TLSv1.0    :DHE-PSK-AES128-CBC-SHA256 SSLv3      :RSA-PSK-AES128-CBC-SHA
SSLv3      :DHE-PSK-AES128-CBC-SHA    SSLv3      :AES128-SHA
TLSv1.0    :PSK-AES128-CBC-SHA256     SSLv3      :PSK-AES128-CBC-SHA
---
Ciphers common between both SSL end points:
TLS_AES_256_GCM_SHA384     TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256
ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-SHA384  ECDHE-RSA-AES256-SHA384    DHE-RSA-AES256-SHA256
ECDHE-ECDSA-AES128-SHA256  ECDHE-RSA-AES128-SHA256    DHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA     ECDHE-RSA-AES256-SHA       DHE-RSA-AES256-SHA
ECDHE-ECDSA-AES128-SHA     ECDHE-RSA-AES128-SHA       DHE-RSA-AES128-SHA
AES256-GCM-SHA384          AES128-GCM-SHA256          AES256-SHA256
AES128-SHA256              AES256-SHA                 AES128-SHA
Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:OQS Default Signature Algorithm:ECDSA p256 - OQS Default Signature Algorithm:RSA3072 - OQS Default Signature Algorithm:Dilithium-2:ECDSA p256 - Dilithium-2:RSA3072 - Dilithium-2:Dilithium-3:Dilithium-4:ECDSA p384 - Dilithium-4:Picnic L1 FS:ECDSA p256 - Picnic L1 FS:RSA3072 - Picnic L1 FS:Picnic2 L1 FS:ECDSA p256 - Picnic2 L1 FS:RSA3072 - Picnic2 L1 FS:qTesla-I-p:ECDSA p256 - qTesla-I-p:RSA3072 - qTesla-I-p:qTESLA-p-III:ECDSA p384 - qTESLA-p-III:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1:DSA+SHA224:DSA+SHA1:DSA+SHA256:DSA+SHA384:DSA+SHA512
Shared Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:OQS Default Signature Algorithm:ECDSA p256 - OQS Default Signature Algorithm:RSA3072 - OQS Default Signature Algorithm:Dilithium-2:ECDSA p256 - Dilithium-2:RSA3072 - Dilithium-2:Dilithium-3:Dilithium-4:ECDSA p384 - Dilithium-4:Picnic L1 FS:ECDSA p256 - Picnic L1 FS:RSA3072 - Picnic L1 FS:Picnic2 L1 FS:ECDSA p256 - Picnic2 L1 FS:RSA3072 - Picnic2 L1 FS:qTesla-I-p:ECDSA p256 - qTesla-I-p:RSA3072 - qTesla-I-p:qTESLA-p-III:ECDSA p384 - qTESLA-p-III:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1
Supported Elliptic Groups: kyber512
Shared Elliptic groups: kyber512
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: BC842CFAE63738AE998BC2A1EC0608FC457A7382F331AB9D1FDE363F8364DD20
    Session-ID-ctx: 01000000
    Resumption PSK: 94234BE186149FC4C8462848DEEB4232CFBE0335A2C03F3C4304DDBA43C3B127FE1DC4B1D1CC7FBA656978B674021F8F
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1588071105
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
   0 items in the session cache
   0 client connects (SSL_connect())
   0 client renegotiates (SSL_connect())
   0 client connects that finished
   1 server accepts (SSL_accept())
   0 server renegotiates (SSL_accept())
   1 server accepts that finished
   0 session cache hits
   0 session cache misses
   0 session cache timeouts
   0 callback cache hits
   0 cache full overflows (128 allowed)
---
no client certificate available

I have recied this how to connect this reult with API so that i can view the working model of cryptography,

Nginx:
On browsing the site https://localhost:4433

httpd:
Subject=CN = httpd.demo.openquantumsafe.or
issuer=CN = oqstest CA

No client certificate CA names sent
Peer signature type: qTesla-I-p
Server Temp Key: saber

SSL handshake has read 21667 bytes and written 1365 bytes
Verification error: unable to verify the first certificate

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 119040 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)

QUIC docker execution error

Hello,

I am trying to install the QUIC docker server and client for testing purposes. I am having issues with the Docker client execution.

Error:

make[2]: Leaving directory '/root/msquic/build/linux/x64_openssl'
[ 98%] Built target msquictest
make[1]: Leaving directory '/root/msquic/build/linux/x64_openssl'
make: *** [Makefile:141: all] Error 2
CMake-Execute: /root/msquic/scripts/build.ps1:449
Line |
449 | CMake-Execute $Arguments
| ~~~~~~~~~~~~~~~~~~~~~~~~
| [02/18/2022 21:42:39] CMake exited with status code 2

The command '/bin/sh -c pwsh /root/msquic/scripts/build.ps1 -Config Debug -Arch x64 -Tls openssl' returned a non-zero code: 1

I have seen this error on msquic's website and they ask to use: git submodule update --init --recursive
Not sure exactly where in the client code to add this.

Nginx-ingres controller building & deployment error

Hi, thanks for the awesome work on developing the LibOQS.
I was building nginx Ingress-controller to deploy it on the GKE.
I used the nginx (oqs-demo) to build the nginx-ingres controller image.

But when I deploy it , says the following error:
Error creating TemplateExecutor: open nginx-plus.tmpl: no such file or directory.

Thanks

Error when compiling OQS-OpenSSL

I get the following error when compiling OQS-OpenSSL, any idea what it could mean (i have pulled the latest version):

/usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(s3_lib.o): in function ssl3_clear':
s3_lib.c:(.text+0x51b): undefined reference to OQS_KEM_free' /usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(extensions_clnt.o): in function tls_construct_ctos_key_share':
extensions_clnt.c:(.text+0x19fa): undefined reference to OQS_KEM_new' /usr/bin/ld: extensions_clnt.c:(.text+0x1a87): undefined reference to OQS_KEM_keypair'
/usr/bin/ld: extensions_clnt.c:(.text+0x1b35): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_clnt.c:(.text+0x1b3f): undefined reference to OQS_MEM_insecure_free'
/usr/bin/ld: extensions_clnt.c:(.text+0x1b62): undefined reference to OQS_KEM_free' /usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(extensions_clnt.o): in function tls_parse_stoc_key_share':
extensions_clnt.c:(.text+0x4202): undefined reference to OQS_KEM_decaps' /usr/bin/ld: extensions_clnt.c:(.text+0x4317): undefined reference to OQS_MEM_secure_free'
/usr/bin/ld: extensions_clnt.c:(.text+0x4335): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_clnt.c:(.text+0x4353): undefined reference to OQS_KEM_free'
/usr/bin/ld: extensions_clnt.c:(.text+0x477d): undefined reference to OQS_KEM_new' /usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(extensions_srvr.o): in function tls_parse_ctos_key_share':
extensions_srvr.c:(.text+0x1708): undefined reference to OQS_KEM_new' /usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(extensions_srvr.o): in function tls_construct_stoc_key_share':
extensions_srvr.c:(.text+0x4431): undefined reference to OQS_KEM_new' /usr/bin/ld: extensions_srvr.c:(.text+0x447c): undefined reference to OQS_KEM_encaps'
/usr/bin/ld: extensions_srvr.c:(.text+0x45c4): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_srvr.c:(.text+0x45cc): undefined reference to OQS_KEM_free'
/usr/bin/ld: extensions_srvr.c:(.text+0x4891): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_srvr.c:(.text+0x489c): undefined reference to OQS_KEM_free'
/usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(t1_lib.o): in function nid_cb': t1_lib.c:(.text+0x234): undefined reference to OQS_KEM_alg_is_enabled'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function pkey_oqs_digestverify': oqs_meth.c:(.text+0x13d): undefined reference to OQS_SIG_verify'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function pkey_oqs_digestsign': oqs_meth.c:(.text+0x47b): undefined reference to OQS_SIG_sign'
/usr/bin/ld: extensions_srvr.c:(.text+0x45c4): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_srvr.c:(.text+0x45cc): undefined reference to OQS_KEM_free'
/usr/bin/ld: extensions_srvr.c:(.text+0x4891): undefined reference to OQS_MEM_secure_free' /usr/bin/ld: extensions_srvr.c:(.text+0x489c): undefined reference to OQS_KEM_free'
/usr/bin/ld: /opt/openssl/.openssl/lib/libssl.a(t1_lib.o): in function nid_cb': t1_lib.c:(.text+0x234): undefined reference to OQS_KEM_alg_is_enabled'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function pkey_oqs_digestverify': oqs_meth.c:(.text+0x13d): undefined reference to OQS_SIG_verify'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function pkey_oqs_digestsign': oqs_meth.c:(.text+0x47b): undefined reference to OQS_SIG_sign'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function oqs_free': oqs_meth.c:(.text+0x325e): undefined reference to OQS_SIG_free'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function oqs_key_init': oqs_meth.c:(.text+0x3822): undefined reference to OQS_SIG_alg_is_enabled'
/usr/bin/ld: oqs_meth.c:(.text+0x382e): undefined reference to OQS_SIG_new' /usr/bin/ld: oqs_meth.c:(.text+0x3968): undefined reference to OQS_SIG_free'
/usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function pkey_oqs_keygen': oqs_meth.c:(.text+0x3b09): undefined reference to OQS_SIG_free'
/usr/bin/ld: oqs_meth.c:(.text+0x3c28): undefined reference to OQS_SIG_keypair' /usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function oqs_priv_decode':
oqs_meth.c:(.text+0x40ae): undefined reference to OQS_SIG_free' /usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function oqs_pub_decode':
oqs_meth.c:(.text+0x445e): undefined reference to OQS_SIG_free' /usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function OQSKEM_options':
oqs_meth.c:(.text+0x45b3): undefined reference to OQS_KEM_alg_is_enabled' /usr/bin/ld: /opt/openssl/.openssl/lib/libcrypto.a(oqs_meth.o): in function OQSSIG_options':
oqs_meth.c:(.text+0x4673): undefined reference to OQS_SIG_alg_is_enabled' collect2: error: ld returned 1 exit status

Re-activate OSX docker building when supported by CircleCI

As of now (Mar 2020) CircleCI does not support building current OSX docker images, so CCI config needs to be updated if that capability is available again.

The site can't provide a secure connection: https://localhost:4433

Hello Team,
I have bult the chromium demo un ubuntu server but at the last step i have recived the error "The site can't provide a secure connection". Client ans server dont support the common ssl.
I am able to successfully rin the TLS connection in boringssl

caant add certificate on httpd

whenever I try to create and add test certificate the following error pops up

req: Can't open "/opt/tmp/CA.key" for writing, Permission denied
failed to resize tty, using default size

on exploring the container files with shell no tmp folder is found and am unable to create it using mkdir
Please help

Suggestions to support another solution for a demo

I suppose the pattern to support liboqs is to

identify where encrypted communication takes place in the code base
in there identify how a specific algorithm is selected
change, or better in the long run generalize, the selection of an algorithm
rely on liboqs (direct use in C or current wrappers for C++ C# Rust Python Go or Java) to encrypt/decrypt messages or if available at a higher level (e.g oqs openssl or boringssl)
verify that communication of messages encrypted through the new algorithm can get decrypted

If this is not correct what should be considered instead?

These is asked in terms of https://github.com/matrix-org/matrix-doc/issues/3516 to potentially demo https://github.com/matrix-org/synapse with oqs.

Add Mosquitto support

Hi, I integrated OQS-OpenSSL into Mosquitto and provided a Dockerfile to fully automate the integration.

May I pull request to main branch? (#136)

Thanks!

--Chia-Chin Chung

Forwarding to HTTPS requests from clients not supporting post-quantum cipher-suite

I have setup a test OQS Nginx server, that integrates your OQS fork of OpenSSL. I was wondering how to route clients to different server ports based on the cipher suites they support. In your test server: https://test.openquantumsafe.org/ I can see that the site is accessible using clients that do not support post-quantum TLS as well, and that the site then uses a classical certificate. But if I use your OQS curl demo https://github.com/open-quantum-safe/oqs-demos/tree/main/curl, that supports post-quantum TLS, I can get a response from your test serve when curving with a post-quantum key-exchange algorithm such as Kyber512, doing the following:

docker run -it oqs-curl curl -k https://test.openquantumsafe.org --curves kyber512

So my question is how can you identify clients that do not support post-quantum TLS and then use a classical certificate for those types of clients, if i've understood the setup correctly.

TLS decrypt error

Error when compiling nginx

I'm getting the following error when I run the ./configure nginx script that also should compile the OQS fork of OpenSSL with.

These are my configure arguments:

./configure --with-http_ssl_module --with-openssl=/home/ibra/pqs_server_files/openssl --with-openssl-opt='zlib no-tests' --with-cc-opt=-I/home/ibra/pqs_server_files/openssl/oqs/include --with-ld-opt=-L/home/ibra/pqs_server_files/openssl/oqs/lib

Any ideas what that could mean?

Chromium fails to connect to QSC-signature protected server

"Weak key" error when connecting Chromium to QSC-sig cert protected test port, e.g., https://test.openquantumsafe.org:6471/

Upgrade Chromium demo code

85.0.4161.2 seems dated relying on software packages not state of the art any more

Depends on open-quantum-safe/boringssl#57

Add --groups option to Chromium

Goal would be to enable using/testing all supported QSC algorithms.

Low priority.

Failed to build Chromium

Hi, I'm trying to build Chromium using the oqs-demos/chromium. The first few steps are executed successfully. But when I type autoninja -C out/Default chrome to build Chromium, I get an error message.
Just like:

FAILED: obj/third_party/boringssl/boringssl/p_oqs.o
../../third_party/boringssl/src/crypto/evp/p_oqs.c:19:10: fatal error: 'oqs/oqs.h' file not found
#include <oqs/oqs.h>
         ^~~~~~~~~~~
1 error generated.
...
FAILED: obj/third_party/boringssl/boringssl/p_oqs_asn1.o
...
../../third_party/boringssl/src/crypto/evp/p_oqs_asn1.c:20:10: fatal error: 'oqs/oqs.h' file not found
...
ninja: build stopped: subcommand failed.

How can I fix it? Thank you for your help!!

Detach openssh from liboqs-0.4.0

Move to more current openssh when open-quantum-safe/openssh#78 is landed

Automate test server usage

Script to verify (new) client code can interact with all algorithms supported by test server

enable liboqs-tagged builds

By default, demos are always built using the current upstream masters.
For interoperability and regression testing, specific builds tagged to a liboqs release tag and all corresponding downstream package versions are sensible additional build options. This feature can then also be used to automate generating liboqs-version-tagged docker images for all applications and thus, improve (reduce) release-cycle build time over the complete OQS SW stack.

Challenge is that (tag-)conditional Dockerfiles make builds un-cacheable.
Additional challenge is that such logic would have to be copied into each Dockerfile as there seems to be no #include logic in Dockerfiles.
Another challenge is that more parameters than just tags need to be considered (other upstream options change over time, e.g. OQS_USE_CPU_EXTENSIONS came and went away).

Maybe just keeping liboqs-version-tagged Dockerfiles is sufficient?

Can't build oqs-demos/chromium

I followed the instructions at
https://github.com/open-quantum-safe/oqs-demos/tree/main/chromium .

I am building on Ubuntu 20.04 .

The first build error I got was :

ninja: Entering directory `out/Default'
[1/1] Regenerating ninja files
FAILED: build.ninja
../../buildtools/linux64/gn --root=../.. -q gen .
ERROR at //third_party/boringssl/BUILD.gn:48:46: Undefined identifier
all_headers = crypto_headers + ssl_headers + oqs_headers
^----------
See //crypto/BUILD.gn:78:19: which caused the file to be included.
public_deps = [ "//third_party/boringssl" ]
^------------------------

I tried to comment out oqs_headers . Then I hit the following :

../../net/cert/internal/simple_path_builder_delegate.cc:38:7: error: use of undeclared identifier 'IS_OQS_PKEY'
if (IS_OQS_PKEY(curve_nid)) {
^
../../net/cert/internal/simple_path_builder_delegate.cc:117:7: error: use of undeclared identifier 'IS_OQS_PKEY'
if (IS_OQS_PKEY(pkey_id)) {
^
2 errors generated.

It looks like the oqs-mods.patch file is quite old - 5 months.
I don't think it works with the current liboqs 0.7.0 .
I tried liboqs 0.6.0 and 0.5.0, and reinstalled them into the Chromium tree, but I still hit the same error.

Can someone please provide the proper version of liboqs I should be using with Chromium, as well as the correct patch ?

Thanks.

issue with step #5 of Chromium

Hi,
I have completed the steps of oqs demo for Chromium up to step 5.
for number 5 it has been said:
"navigate to <CHROMIUM_ROOT> and apply the chromium94.patch file provided here by running git apply <PATH_TO_PATCH_FILE>."

what should I do in this step? what will be the value of <PATH_TO_PATCH_FILE>?
should I have chromium94.patch in my directory? Because I have searched for a file with this name but there is no file with this name.

Thank you.

open-quantum-safe / oqs-demos Goto Github PK

oqs-demos's People

Contributors

Stargazers

Watchers

Forkers

oqs-demos's Issues

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 9909 bytes Verification: OK

New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok)

My system

What I tried

What happened

Comments

No client certificate CA names sent Peer signature type: qTesla-I-p Server Temp Key: saber

SSL handshake has read 21667 bytes and written 1365 bytes Verification error: unable to verify the first certificate

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 119040 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 21 (unable to verify the first certificate)

Recommend Projects

Recommend Topics

Recommend Org

SSL handshake has read 7 bytes and written 9909 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

No client certificate CA names sent
Peer signature type: qTesla-I-p
Server Temp Key: saber

SSL handshake has read 21667 bytes and written 1365 bytes
Verification error: unable to verify the first certificate

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 119040 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)