2.2. Post-quantum cryptography algorithms in OpenSSL

You can use the OpenSSL TLS toolkit to generate keys and certificates with post-quantum algorithms. This helps enhance security against emerging threats while maintaining compatibility with traditional algorithms.

Starting with RHEL 10.1, you can use OpenSSL for generating keys, signing messages, verifying signatures, and creating X.509 certificates with the ML-DSA post-quantum algorithms.

From OpenSSL 3.5, the hybrid ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) method is preferred in TLS 1.3 handshakes. OpenSSL includes keys with both traditional algorithms and ML-KEM. The use of ML-KEM results in a slight delay in the initiation of TLS connections. Still, it does not affect performance after the handshake, as further communication uses a more efficient symmetric key.

$ openssl req \
    -x509 \
    -newkey mldsa65 \
    -keyout <localhost-mldsa.key> \
    -subj /CN=<localhost> \
    -addext subjectAltName=DNS:<localhost> \
    -days <30> \
    -nodes \
    -out <localhost-mldsa.crt>

$ openssl s_server \
    -cert <localhost-mldsa.crt> -key <localhost-mldsa.key> \
    -dcert <localhost-rsa.crt> -dkey <localhost-rsa.key> >/dev/null &

$ openssl s_client \
    -connect <localhost:4433> \
    -CAfile <localhost-mldsa.crt> </dev/null \
    |& grep -E '(Peer signature type|Negotiated TLS1.3 group)'
Peer signature type: mldsa65
Negotiated TLS1.3 group: X25519MLKEM768

$ openssl s_client \
    -connect <localhost:4433> \
    -CAfile <localhost-rsa.crt> \
    -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' \
    -groups 'X25519:secp256r1:X448:secp521r1:secp384r1' </dev/null \
    |& grep -E '(Peer signature type|Server Temp Key)'
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits

You can configure a server to simultaneously use traditional certificates (RSA, ECDSA, and EdDSA) and post-quantum certificates. The server automatically and transparently selects the certificates preferred and supported by clients: the post-quantum for new clients and traditional for legacy ones.

See the openssl(1), openssl-genpkey(1), openssl-pkey(1), openssl-dgst(1), and openssl-verify(1) man pages on your system for more information.