0.9.0-rc1

oqs-provider 0.9.0-rc1

About

The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography. More information on OQS can be found on the website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.

oqs-provider is a standalone OpenSSL 3 provider enabling liboqs-based quantum-safe and hybrid key exchange for TLS 1.3, as well as quantum-safe and hybrid X.509 certificate generation, CMS, CMP and dgst (signature) operations.

When deployed, the oqs-provider binary (shared library) thus adds support for quantum-safe cryptographic operations to any standard OpenSSL(v3) installation. The ultimate goal is that all openssl functionality shall be PQC-enabled.

In general, the oqs-provider main branch is meant to be usable in conjunction with the main branch of liboqs and the master branch of OpenSSL.

Further details on building, testing and use can be found in README.md. See in particular limitations on intended use.

Release notes

This is release candidate 1 of version 0.9.0 of oqs-provider which continues from the earlier 0.8.0 release. This release is fully tested to be used in conjunction with the main branch of liboqs and is guaranteed to be in sync with v0.13.0 of liboqs.

Deprecation notice

This release of oqsprovider removes default support for Kyber and Dilithium (Round 3 version).

What's New

In addition to improving CI and testing, fixing platform specific build issues and bugs, and updating build dependencies this release of oqs-provider:

• Adds support for UOV (NIST Additional Signatures Round 2)
• Adds support for Mayo (NIST Additional Signatures Round 2)
• Adds support for CROSS (NIST Additional Signatures Round 2)
• Disables HQC KEM by default, following liboqs v0.13.0, until a security flaw is fixed.
• Disables default support for Kyber (Round 3 version).
• Disables default support for Dilithium (Round 3 version).
• Restricts non-standard TLS group code points to IANA private use range.
• Updates TLS group code point and name for ML-KEM 1024 hybrid SecP384r1MLKEM1024.
• Disables ML-KEM (along with certain hybrid variants) and ML-DSA (along with all composite/hybrid variants) when oqs-provider is loaded with OpenSSL (version >= 3.5.0) which offers native support for some of these algorithms. Please see README.md for detailed information.

What's Changed

• revert to dev by @baentsch in #602
• Bump jinja2 from 3.1.4 to 3.1.5 in /oqs-template in the pip group by @dependabot in #601
• remove default Kyber and Dilithium support by @baentsch in #603
• Allow overriding OPENSSL_MODULES_PATH from the command line by @embetrix in #607
• change code point and name for mlkem1024 hybrid by @baentsch in #606
• Include use of loaded 'libctx' context in KEM and SIG procedures (#557) by @RodriM11 in #614
• limit testing to oqsprovider by @baentsch in #611
• add more complete KEM ENCODERS testing in recent openssl versions by @baentsch in #616
• enable run-time disablement for erroring algs in openssl 3.5 by @baentsch in #642
• Update fullbuild.sh by @dgargar-laude in #633
• Update fullbuild.sh - add OSSL_CONFIG variable for customization. by @tglowka in #640
• restrict libctx test to oqsprovider by @baentsch in #620
• update SIG alg info by @baentsch in #645
• Drop oqsprovider2, appears unused by @vdukhovni in #648
• Integrate UOV by @mkannwischer in #651
• Integrate liboqs upstream updates by @SWilson4 in #657
• Fix windows build in CI by @bhess in #656
• Update OIDs for CROSS 2.0 by @rtjk in #652
• Update OIDs and code points for MAYO round 2 by @bhess in #654
• Update GOVERNANCE.md by @ashman-p in #664
• Prepare for 0.9.0 release by @praveksharma in #670
• Make non-standard TLS code points IANA compliant by @praveksharma in #676
• Finalise #671 by @praveksharma in #678
• Make NID lookup for hybrid KEMs with P and X curves more robust by @Lekensteyn in #671
• Update HQC codepoints following #676 by @praveksharma in #680

New Contributors

• @embetrix made their first contribution in #607
• @RodriM11 made their first contribution in #614
• @dgargar-laude made their first contribution in #633
• @tglowka made their first contribution in #640
• @vdukhovni made their first contribution in #648
• @mkannwischer made their first contribution in #651
• @rtjk made their first contribution in #652
• @Lekensteyn made their first contribution in #671

Full Changelog: 0.8.0...0.9.0-rc1