Comments (16)
Hi Michael,
Sorry it's taken me a while to get back to you. I've been investigating an easier way to demonstrate cryptographic agility using HA-Proxy in front of my old application and got it working with OQS-Chrome as the client. Using a proxy has been far easier than trying to implement PQC at the code layer. None of those nasty dependancies. I may loop back to this issue in some time but for now I'm exploring rapid PQC by enabling a proxy layer for my apps.
from oqs-demos.
Thanks for the feedback. You're not the only one using that approach & that's been the reason for doing/maintaining oqs-haproxy. Labelled this issue thus "future work" (may or may not be done).
from oqs-demos.
I’m wondering if you’ve investigated Envoy as another proxy? It’s been very popular.
https://www.envoyproxy.io/
from oqs-demos.
Not yet but thanks for the suggestion. Before looking into it, can I ask why you didn't use it?
Edit after reading up a bit on envoy: envoy seems to be rather intimately combined with BoringSSL without strong interest in adding OpenSSL support; OpenSSL plugin seems to be in the works since a long time but not really pursued, so one probably couldn't build on that.
Why is this relevant? We put more focus on (and features in) the OQS-OpenSSL code base compared to OQS-BoringSSL.
from oqs-demos.
That makes sense to me. We're just exploring the use of Envoy over HA-proxy.
from oqs-demos.
OK - thanks for letting us know. Please touch base again if you've decided one way or the other so we can prioritize our efforts suitably.
from oqs-demos.
I'm curious what features are missing from your OQS-BoringSSL implementation? Is there a significant LoE to upgrade OQS-BoringSSL?
from oqs-demos.
I'm curious what features are missing from your OQS-BoringSSL implementation? Is there a significant LoE to upgrade OQS-BoringSSL?
OQS-BoringSSL does not support hybrid signatures (and there are no plans to implement this currently). The other limitations are those of stock BoringSSL (no CMS, X509 and ASN1 APIs considered deprecated, etc.).
from oqs-demos.
In addition, OQS-BoringSSL isn't regularly kept up-to-date with its upstream (compared to OQS-OpenSSL).
from oqs-demos.
In addition, OQS-BoringSSL isn't regularly kept up-to-date with its upstream (compared to OQS-OpenSSL).
Yes, in OQS we primarily use BoringSSL to demonstrate the use of PQ cryptography in Chromium, and we pin the BoringSSL commit to the desired Chromium tag for which we've verified that the demo works. We don't do this frequently.
from oqs-demos.
We are going down the path of Envoy, and eventually extend to Istio. for a PQC service mesh.
from oqs-demos.
Thanks for letting us know. Do you plan to do this open source? If so, please let us know if/where we can help/cooperate.
from oqs-demos.
Yeah Ideally my team and I will make an Open Source OQS-Envoy - perhaps we can list it here as another demo?
I'm still very new to this so any assistance would be greatly appreciated!
from oqs-demos.
My main concerns are around the limited functionality of Boring-SSL as you've pointed out earlier.
from oqs-demos.
I'm still very new to this so any assistance would be greatly appreciated!
We'd be glad to help where we can. Just renamed this issue so we can discuss (upcoming) issues below.
My main concerns are around the limited functionality of Boring-SSL as you've pointed out earlier.
Would it make sense to spell out the functional and non-functional goals you may already know about so we can also "think along"?
from oqs-demos.
No recent activity, closing issue. Feel free to reopen if there's renewed interest/activity.
from oqs-demos.
Related Issues (20)
- unable to pull the chrome file from server HOT 1
- Cannot switch off OQS_HAVE_GETENTROPY, OQS_HAVE_EXPLICIT_BZERO HOT 3
- Fix integrations to specific commits?
- OQS Chromium(117.0.5863.0) : ERR_SSL_VERSION_OR_CIPHER_MISMATCH HOT 15
- curl --write-out time_appconnect for SSL/TLS Handshake variable is faulty HOT 4
- Failed to build oqs-nginx on Mac M1
- Failed to build httpd on Mac M1 HOT 1
- ee key too small has occured in nginx with debian:bookworm-slim HOT 5
- https://test.openquantumsafe.org:6000 does not accept `x25519_kyber768`
- Wireshark Docker Build Fails with WolfSSL Due to Undeclared 'QSC_SIG_CPS' Variable HOT 1
- Update test server with liboqs 0.9.2 release HOT 3
- Introduce CI mechanism to use specific liboqs/oqs-provider versions
- Add QUIC support HOT 3
- !DOCTYPE ERROR HOT 1
- Not able to get OQS-Chromium browser working - https://openquantumsafe.org/applications/tls.html#chromium HOT 19
- oqs-epiphany not working HOT 11
- qteslapi is not supported by oqs openssl HOT 1
- Dont get Server Temp Key in openssl s_client when testing HOT 1
- Update test server with liboqs 0.10.0 release HOT 8
- HAProxy HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oqs-demos.