How to create client TLS connection to post-quantum port?

[chris-giblin]

I would like to use BC to test client-side post-quantum TLS. I am noob to pq so I may be overlooking details in the set up. Is there an example available showing how to establish a pq TLS client connection?

Using the bc-173b10 beta, I attempt to connect to kyber ports at the Open Quantum Safe interop test server, however without success. Looks like the server is closing the socket during the handshake.

TLS client received alert: fatal(2), handshake_failure(40)
org.bouncycastle.tls.TlsFatalAlertReceived: handshake_failure(40)
at org.bouncycastle.tls.TlsProtocol.handleAlertMessage(TlsProtocol.java:244)
at org.bouncycastle.tls.TlsProtocol.processAlertQueue(TlsProtocol.java:736)
at org.bouncycastle.tls.TlsProtocol.processRecord(TlsProtocol.java:559)
at org.bouncycastle.tls.RecordStream.readRecord(RecordStream.java:245)
at org.bouncycastle.tls.TlsProtocol.safeReadRecord(TlsProtocol.java:875)
at org.bouncycastle.tls.TlsProtocol.blockForHandshake(TlsProtocol.java:422)
at org.bouncycastle.tls.TlsClientProtocol.connect(TlsClientProtocol.java:88)

Thanks!

[peterdettman]

We haven't yet added any support for cipher suites that would use any of the PQC algorithms. i.e. while we have a Kyber implementation we haven't integrated it for use with TLS.

[projjwalraj707]

Is it still the case that MLKEM is not integrated with TLS?

[peterdettman]

1.81 will be released in the next week or so and will have hybrid ECDHE-MLKEM groups per draft-ietf-tls-ecdhe-mlkem-00. ML-KEM was already in earlier versions, however the codepoints for those groups are also being updated in 1.81 per draft-connolly-tls-mlkem-key-agreement-05 .

[projjwalraj707]

Thanks for the reply. Can you please briefly guide me how I can create a TLS Server using MLKEM algo.

[projjwalraj707]

"while we have a Kyber implementation we haven't integrated it for use with TLS". Is this statement still true? If yes, what is the purpose of org.bouncycastle.tls.crypto.impl.bc.BcTlsMLKem?

[peterdettman]

As stated above, 1.81 (now released) supports ML-KEM groups (draft-connolly-tls-mlkem-key-agreement-05) as well as hybrid ECDHE-MLKEM groups (draft-ietf-tls-ecdhe-mlkem-00). These are all only available in TLS 1.3 (per specification) and are used just like any other NamedGroup (e.g. x25519).

[chris-giblin]

Great, thanks for the clarification!