-
Notifications
You must be signed in to change notification settings - Fork 49
Description
In the last years, post-quantum cryptographic algorithms have been the subject of significant standardization and implementation efforts.
For example, IETF draft https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ has introduced a few post-quantum key algorithms which can be used for TLS key agreement purposes. OpenSSL 3.5 (https://github.com/openssl/openssl/releases/tag/openssl-3.5.0) has implemented one such algorithm, X25519MLKEM768. Public tutorials already explain how to set up popular web servers (Apache HTTPD, Nginx) to use post quantum algorithms.
On the client side, major browsers including Google Chrome (https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) are already supporting these algorithms.
It may be useful to ensure Elastic Beats, especially Heartbeat, support algorithms such as X25519MLKEM768. If this trend is not promptly followed, it may become difficult or impossible to monitor (using Heartbeat) the status of websites and applications which, in some time, may discourage (if not outright reject) TLS handshakes if they do not support post-quantum algorithms.
Public tests may already be possible through this initiative https://test.openquantumsafe.org/ (I do not endorse it and I'm not responsible for it). Alternatively, web servers may be set up using recent OpenSSL releases or equivalent tooling.
Regarding documentation, I believe this is the right place: https://www.elastic.co/docs/reference/beats/heartbeat/configuration-ssl