/openssl

Fork of OpenSSL that includes quantum-resistant algorithms and ciphersuites based on liboqs.

Primary LanguageCOtherNOASSERTION

open-quantum-safe/openssl

OpenSSL is an open-source TLS/SSL and crypto library https://openssl.org/. (View the original README file for OpenSSL.)

This repository contains a fork of OpenSSL that adds quantum-safe cryptographic algorithms and ciphersuites.

Overview

The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography.

liboqs is an open source C library for quantum-safe cryptographic algorithms. liboqs initially focuses on key exchange algorithms. See more about liboqs at https://github.com/open-quantum-safe/liboqs/, including a list of supported algorithms.

open-quantum-safe/openssl is an integration of liboqs into OpenSSL 1.0.2. The goal of this integration is to provide easy prototyping of quantum-resistant cryptography. The integration should not be considered "production quality".

More information on OQS can be found on our website: https://openquantumsafe.org/.

Contents

open-quantum-safe/openssl currently contains:

  • Integration of post-quantum key exchange primitives from liboqs into OpenSSL's speed command
  • Ciphersuites using post-quantum key exchange and authentication based on primitives from liboqs, including hybrid ciphersuites which also use ECDHE key exchange

Our modifications are only for OpenSSL v1.0.2, and appear only on the OpenSSL_1_0_2-stable branch.

Key exchange mechanisms

liboqs currently supports the following key exchange mechanisms:

Authentication mechanisms

liboqs currently supports the following authentication mechanisms:

Ciphersuites

For each post-quantum key exchange primitive X, there are the following ciphersuites:

  • OQSKEX-X-RSA-AES128-GCM-SHA256
  • OQSKEX-X-ECDSA-AES128-GCM-SHA256
  • OQSKEX-X-RSA-AES256-GCM-SHA384
  • OQSKEX-X-ECDSA-AES256-GCM-SHA384
  • OQSKEX-X-ECDHE-RSA-AES128-GCM-SHA256
  • OQSKEX-X-ECDHE-ECDSA-AES128-GCM-SHA256
  • OQSKEX-X-ECDHE-RSA-AES256-GCM-SHA384
  • OQSKEX-X-ECDHE-ECDSA-AES256-GCM-SHA384

There is also a "generic" ciphersuite (X = GENERIC) which uses whichever key exchange primitive is configured as the default key exchange primitive in liboqs. It is set to GENERIC = RLWE-BCNS15, but this can be changed.

The following ciphersuites using the Picnic authentication mechanisms are supported:

  • OQSKEX-LWE-FRODO-RECOMMENDED-PICNIC-AES256-GCM-SHA384
  • OQSKEX-LWE-FRODO-RECOMMENDED-ECDHE-PICNIC-AES256-GCM-SHA384
  • OQSKEX-RLWE-MSRLN16-PICNIC-AES256-GCM-SHA384
  • OQSKEX-RLWE-MSRLN16-ECDHE-PICNIC-AES256-GCM-SHA384
  • OQSKEX-SIDH-MSR-PICNIC-AES256-GCM-SHA384
  • OQSKEX-SIDH-MSR-ECDHE-PICNIC-AES256-GCM-SHA384

Building

Builds have been tested on Mac OS X 10.11.6, macOS 10.12, Ubuntu 16.04.1, and Windows 10.

Linux and macOS

To build, clone or download the source from Github:

git clone --branch OpenSSL_1_0_2-stable https://github.com/open-quantum-safe/openssl.git
cd openssl

To configure OpenSSL, on Linux type:

./config

and on Mac OS X type:

./Configure darwin64-x86_64-cc

Then type:

make depend
make

This will build both liboqs and OpenSSL.

Windows

Windows binaries can be generated using the standard build process for OpenSSL on Windows.

Running

See the liboqs Github site for information on test programs in liboqs.

openssl speed

OpenSSL's speed command performs basic benchmarking of cryptographic primitives. You can see results for primitives from liboqs by typing

apps/openssl speed oqskex

TLS demo

OpenSSL contains a basic TLS server (s_server) and TLS client (s_client) which can be used to demonstrate and test SSL/TLS connections.

To see the list of supported ciphersuites from OQS, type:

apps/openssl ciphers OQSKEX-GENERIC:OQSKEX-GENERIC-ECDHE:OQSKEX-RLWE-BCNS15:OQSKEX-RLWE-BCNS15-ECDHE:OQSKEX-RLWE-NEWHOPE:OQSKEX-RLWE-NEWHOPE-ECDHE:OQSKEX-RLWE-MSRLN16:OQSKEX-RLWE-MSRLN16-ECDHE:OQSKEX-LWE-FRODO-RECOMMENDED:OQSKEX-LWE-FRODO-RECOMMENDED-ECDHE:OQSKEX-SIDH-MSR:OQSKEX-SIDH-MSR-ECDHE:OQSKEX-SIDH-IQC-REF:OQSKEX-SIDH-IQC-REF-ECDHE:OQSKEX-CODE_MCBITS:OQSKEX-CODE-MCBITS-ECDHE:OQSKEX-NTRU:OQSKEX-NTRU-ECDHE:OQSKEX-MLWE-KYBER:OQSKEX-MLWE-KYBER-ECDHE

To run a server, we first need to generate a self-signed X.509 certificate. Run the following command:

apps/openssl req -x509 -new -newkey rsa:2048 -keyout server.key -nodes -out server.cer -sha256 -days 365 -config apps/openssl.cnf

Hit enter in response to all the prompts to accept the defaults.

When done, type to combine the key and certificate (as required by s_server):

cat server.key server.cer > server.pem

To run a basic TLS server with all OQS ciphersuites enabled:

apps/openssl s_server -cipher OQSKEX-GENERIC:OQSKEX-GENERIC-ECDHE:OQSKEX-RLWE-BCNS15:OQSKEX-RLWE-BCNS15-ECDHE:OQSKEX-RLWE-NEWHOPE:OQSKEX-RLWE-NEWHOPE-ECDHE:OQSKEX-RLWE-MSRLN16:OQSKEX-RLWE-MSRLN16-ECDHE:OQSKEX-LWE-FRODO-RECOMMENDED:OQSKEX-LWE-FRODO-RECOMMENDED-ECDHE:OQSKEX-SIDH-MSR:OQSKEX-SIDH-MSR-ECDHE

In another terminal window, you can run a TLS client for any or all of the supported ciphersuites, for example:

apps/openssl s_client -cipher OQSKEX-GENERIC
apps/openssl s_client -cipher OQSKEX-GENERIC-ECDHE
apps/openssl s_client -cipher OQSKEX-RLWE-BCNS15
apps/openssl s_client -cipher OQSKEX-RLWE-BCNS15-ECDHE
apps/openssl s_client -cipher OQSKEX-RLWE-NEWHOPE
apps/openssl s_client -cipher OQSKEX-RLWE-NEWHOPE-ECDHE
apps/openssl s_client -cipher OQSKEX-RLWE-MSRLN16
apps/openssl s_client -cipher OQSKEX-RLWE-MSRLN16-ECDHE
apps/openssl s_client -cipher OQSKEX-LWE-FRODO-RECOMMENDED
apps/openssl s_client -cipher OQSKEX-LWE-FRODO-RECOMMENDED-ECDHE
apps/openssl s_client -cipher OQSKEX-SIDH-MSR
apps/openssl s_client -cipher OQSKEX-SIDH-MSR-ECDHE
apps/openssl s_client -cipher OQSKEX-SIDH-IQC-REF
apps/openssl s_client -cipher OQSKEX-SIDH-IQC-REF-ECDHE
apps/openssl s_client -cipher OQSKEX-CODE-MCBITS
apps/openssl s_client -cipher OQSKEX-CODE-MCBITS-ECDHE
apps/openssl s_client -cipher OQSKEX-NTRU
apps/openssl s_client -cipher OQSKEX-NTRU-ECDHE
apps/openssl s_client -cipher OQSKEX-MLWE-KYBER
apps/openssl s_client -cipher OQSKEX-MLWE-KYBER-ECDHE

Run the following programs to test the PQC kex+auth TLS connection.

To generate a Picnic key (using a new openssl app genoqs):

apps/openssl genoqs -picnic -out picnic.key

To generate a Picnic cert:

apps/openssl req -new -x509 -days 365 -sha512 -key picnic.key -out picnic.crt -subj "/C=US/L=Redmond/CN=OQStest" -config apps/openssl.cnf

To test a complete (kex+auth) PQS TLS connection, start a server (where X is a mechanism that supports Picnic, see above):

apps/openssl s_server -cipher OQSKEX-X-PICNIC-AES256-GCM-SHA384 -cert picnic.crt -key picnic.key -HTTP

And connect to it with a client (using the same X as the server):

apps/openssl s_client -cipher OQSKEX-X-PICNIC-AES256-GCM-SHA384 -connect localhost:4433

Current status and plans

Our initial launch of the liboqs integration into OpenSSL was on August 25, 2016.

At this point, there are no plans to add further functionality to the OpenSSL integration, beyond supporting additional algorithms added by liboqs. See the liboqs page for more information about liboqs plans.

We will endeavour to regularly sync our branch with commits in the original openssl/openssl repository.

In 2018 we plan to switch development to OpenSSL 1.1.0.

For future reference, adding new algorithms/ciphersuites can easily be done by following these diffs:

Note

Proofs of TLS such as [JKSS12] and [KPW13] require a key exchange mechanism that has a form of active security, either in the form of the PRF-ODH assumption, or an IND-CCA KEM. Most basic post-quantum key exchange mechanisms do not achieve active security, and would need to have an IND-CPA to IND-CCA KEM transform applied [Pei14] or be protected from active attacks using a signature scheme [BCNS15]. Neither countermeasure is currently applied in this prototype OpenSSL integration, so existing proofs of security of TLS against active attackers do not apply to this software. Improving this is an active research goal.

License

All modifications in the open-quantum-safe/openssl repository are released under the same terms as OpenSSL, namely as described in the file LICENSE.

Team

The Open Quantum Safe project is lead by Michele Mosca (University of Waterloo) and Douglas Stebila (McMaster University).

Support

Development of Open Quantum Safe has been supported in part by the Tutte Institute for Mathematics and Computing. Research projects which developed specific components of Open Quantum Safe have been supported by various research grants; see the source papers for funding acknowledgements.

Contributors

Contributors to the liboqs fork of OpenSSL include:

  • Kevin Kane (Microsoft)
  • Tancrède Lepoint (SRI)
  • Shravan Mishra (University of Waterloo)
  • Christian Paquin (Microsoft Research)