Skip to content

TLS 1.3 Hybrid Key Exchange (ML-KEM)

To achieve Post-Quantum Cryptography (PQC) readiness today, standard OS repositories are insufficient. The keysupport.net infrastructure bypasses legacy packages by building OpenSSL and Nginx from scratch.

The Build Process

The container executes a custom compilation script to explicitly link Nginx against a raw build of OpenSSL.

Current target versions in buildOpenSslAndNginx.sh: - Nginx: 1.31.2 - OpenSSL: 3.6.3

/usr/bin/wget https://github.com/openssl/openssl/releases/download/openssl-3.6.3/openssl-3.6.3.tar.gz
/usr/bin/wget https://nginx.org/download/nginx-1.31.2.tar.gz

# Nginx is compiled statically against the OpenSSL 3.6.3 source
./configure --with-http_v2_module \
            --sbin-path=/usr/local/nginx/nginx \
            --conf-path=/usr/local/nginx/nginx.conf \
            --with-http_ssl_module \
            --with-openssl=/usr/local/src/openssl-3.6.3

This allows the Nginx reverse proxy to expose the ssl_ecdh_curve directive with ML-KEM named groups:

ssl_protocols TLSv1.3;
ssl_ecdh_curve SecP384r1MLKEM1024:SecP256r1MLKEM768:X25519MLKEM768:secp384r1;

This guarantees that any capable client connecting to the Validation Service can negotiate a hybrid classical/post-quantum secure channel.

KEM Benchmark

Performance of Key Encapsulation Mechanisms on the host infrastructure: 

                 ML-KEM-512 0.000020s 0.000012s 0.000020s   49789.4   80116.6   49755.4
                 ML-KEM-768 0.000032s 0.000017s 0.000027s   31047.4   59099.9   37110.1
                ML-KEM-1024 0.000048s 0.000022s 0.000035s   20656.4   44675.5   28175.4
             X25519MLKEM768 0.000060s 0.000074s 0.000057s   16620.7   13576.4   17503.4
          SecP256r1MLKEM768 0.000047s 0.000081s 0.000078s   21059.5   12419.3   12751.5
         SecP384r1MLKEM1024 0.000776s 0.001453s 0.000765s    1289.2     688.4    1307.7

PQC Readiness Verification

To verify that your client and the server are correctly negotiating post-quantum cipher suites, we recommend the pqspy tool. pqspy is a utility for monitoring Post-Quantum Cryptography (PQC) within TLS connections.

Repository: bwesterb/pqspy