8000 Add SecP384r1MLKEM1024 by alexw91 · Pull Request #2327 · aws/aws-lc · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Add SecP384r1MLKEM1024 #2327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Apr 18, 2025
Merged

Add SecP384r1MLKEM1024 #2327

merged 7 commits into from
Apr 18, 2025

Conversation

alexw91
Copy link
Contributor
@alexw91 alexw91 commented Apr 10, 2025 •
edited
Loading

Issues:

Adds support for SecP384r1MLKEM1024 from https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/

Description of changes:

Adds support for SecP384r1MLKEM1024 hybrid

Call-outs:

None

Testing:

  1. Added AWS-LC unit tests to perform self-talk with SecP384r1MLKEM1024
  2. Manually tested AWS-LC interoperability of SecP384r1MLKEM1024 against Openssl v3.5.0 with AWS-LC as both client and server
~/workspace/github/aws-lc$ ./build/tool/bssl s_client -curves SecP384r1MLKEM1024:X25519MLKEM768:X25519 -connect 127.0.0.1:44330 -debug
Connecting to 127.0.0.1:44330
Handshake started.
Handshake progress: TLS client enter_early_data
Handshake progress: TLS client read_server_hello
Handshake progress: TLS 1.3 client read_hello_retry_request
Handshake progress: TLS 1.3 client read_server_hello
Handshake progress: TLS 1.3 client read_encrypted_extensions
Handshake progress: TLS 1.3 client read_certificate_request
Handshake progress: TLS 1.3 client read_server_certificate
Handshake progress: TLS 1.3 client read_server_certificate_verify
Handshake progress: TLS 1.3 client read_server_finished
Handshake progress: TLS 1.3 client send_end_of_early_data
Handshake progress: TLS 1.3 client send_client_encrypted_extensions
Handshake progress: TLS 1.3 client send_client_certificate
Handshake progress: TLS 1.3 client complete_second_flight
Handshake progress: TLS 1.3 client done
Handshake progress: TLS client finish_client_handshake
Handshake progress: TLS client done
Handshake done.
Connected.
  Version: TLSv1.3
  Resumed session: no
  Cipher: TLS_AES_128_GCM_SHA256
  ECDHE group: SecP384r1MLKEM1024
  Signature algorithm: ecdsa_secp256r1_sha256
  Secure renegotiation: yes
  Extended master secret: yes
  Next protocol negotiated: 
  ALPN protocol: 
  OCSP staple: no
  SCT list: no
  Early data: no
  Encrypted ClientHello: no
  Cert subject: C = US, ST = WA, L = Seattle, O = Amazon, OU = s2n, CN = localhost
  Cert issuer: C = US, ST = WA, L = Seattle, O = Amazon, OU = s2n, CN = localhost

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@alexw91 alexw91 requested a review from a team as a code owner April 10, 2025 00:01
@codecov-commenter
Copy link
codecov-commenter commented Apr 10, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.77%. Comparing base (508866c) to head (ad67ad6).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #2327      +/-   ##
==========================================
+ Coverage   78.75%   78.77%   +0.01%     
==========================================
  Files         620      620              
  Lines      107936   107954      +18     
  Branches    15336    15336              
==========================================
+ Hits        85008    85038      +30     
+ Misses      22271    22259      -12     
  Partials      657      657

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions GitHub Actions
Copy link
Contributor

Looks good to me!

torben-hansen
torben-hansen reviewed Apr 14, 2025
View reviewed changes
ssl/ssl_key_share.cc
};

CONSTEXPR_ARRAY uint16_t kPQGroups[] = {
SSL_GROUP_KYBER512_R3,
SSL_GROUP_KYBER768_R3,
SSL_GROUP_KYBER1024_R3,
SSL_GROUP_MLKEM512,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this?

Copy link
Contributor Author
@alexw91 alexw91 Apr 14, 2025 •
8000
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noticed that MLKEM-512 was missing from the list of all PQ groups. AWS-LC doesn't offer MLKEM-512 standalone yet, but when it's supported it should be in this list. Adding it now avoid having it be missing later.

This list is used to ensure that one PQ and and one ECDHE KeyShare is sent in the ClientHello.

@alexw91 alexw91 requested a review from torben-hansen April 14, 2025 21:11
@alexw91 alexw91 requested a review from dkostic April 16, 2025 17:16
@andrewhop andrewhop merged commit a8d5f4f into aws:main Apr 18, 2025
50 of 53 checks passed
@justsmth justsmth mentioned this pull request Apr 23, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dkostic dkostic dkostic approved these changes

@torben-hansen torben-hansen torben-hansen approved these changes

@andrewhop andrewhop Awaiting requested review from andrewhop

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@alexw91 @codecov-commenter @dkostic @torben-hansen @andrewhop
0