Configuring PQ in s2n-tls for s2n-quic

[T-449]

Hi,
I was trying to specify which PQ algorithm to use by s2n-tls in s2n-quic. The default post quantum example in 'examples' directory of s2n-quic doesn't provide instructions on how to do this.

I also tried compiling a test code using the api-s in the s2n.h header for s2n-tls. But the compiler can't find the library despite mentioning it explicitly.

[lrstewart]

To clarify, you're trying to use a different PQ key exchange algorithm than the default provided by s2n-quic? What PQ algorithm are you trying to use?

In s2n-tls, algorithm preferences are controlled by security policies: https://github.com/aws/s2n-tls/blob/main/docs/usage-guide/topics/ch06-security-policies.md

And for your build problem, can you provide more details? Are you using C or Rust, and what do you mean by "mentioning it explicitly"?

[T-449]

Yes I am trying to use a different PQ key exchange algorithm. I don't know the default one as the group shows up as Unknown in Wireshark. But what I wanted to find out is where do I specify the tls key exchange mechanism in s2n-quic.

As for s2n-tls I was trying to compile the c code in bin directory. Specifically the s2nc.c and s2nd.c and this was the command I used
gcc -Iapi -Iutils -Itls -Ierror -Icrypto -Lbuild/lib s2nc.c -o s2nc

[T-449]

Is there any way to force a signature/key exchange algorithm when a security policy supports multiple? For example, for default I want to use secp384r1/x25519 instead of secp256r1.

[lrstewart]

s2n-tls doesn't support manually configuring the preference order of signatures or key exchange algorithms. You'd need a security policy with different options. For key exchange, we have some policies like "20240603" that prefer x25519 over secp256r1. We also have one, "rfc9151", which only supports secp384r1, but that policy comes with other strict rules that you may not want. If you're just trying to test the server, you can also use an openssl client configured to only support one algorithm to force the server to choose that one algorithm.

[T-449]

Thanks. It helped. Can you please provide me some details about the security policy "PQ-TLS-1-0-2021-05-26"? Like the info from the tables which you have for the other policies.

[lrstewart]

There's an (undocumented) utility called "policy" that prints out details on a policy:

> ./bin/policy PQ-TLS-1-0-2021-05-26
name: PQ-TLS-1-0-2021-05-26
min version: TLS1.0
rules:
- Perfect Forward Secrecy: no
- FIPS 140-3 (2019): no
cipher suites:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_KYBER_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA256
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_DHE_RSA_WITH_AES_256_CBC_SHA
- TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
signature schemes:
- rsa_pss_pss_sha256
- rsa_pss_pss_sha384
- rsa_pss_pss_sha512
- rsa_pss_rsae_sha256
- rsa_pss_rsae_sha384
- rsa_pss_rsae_sha512
- rsa_pkcs1_sha256
- rsa_pkcs1_sha384
- rsa_pkcs1_sha512
- legacy_rsa_pkcs1_sha224
- ecdsa_sha256
- ecdsa_sha384
- ecdsa_sha512
- legacy_ecdsa_sha224
- rsa_pkcs1_sha1
- ecdsa_sha1
curves:
- x25519
- secp256r1
- secp384r1
pq:
- revision: 0
- kems:
-- kyber512r3
- kem groups:
-- x25519_kyber-512-r3
-- secp256r1_kyber-512-r3

It looks like that uses an old revision of the PQ standard (see "revision: 0"), which is why I didn't include it in the tables. It also allows the TLS1.2 version of PQ kex, which is NOT recommended and will likely be removed in the future.

[T-449]

Thanks a lot :)