Tomcat and oqs

[lhuynh-cs]

Hi

Nginx and Apache httpd are patched to work with oqs, but what about Apache Tomcat ?
Any recommandations for making Tomcat to work with oqs?

The Tomcat "SSL/TLS Configuration How-To" says:

If you use the optional tcnative library, you can use the OpenSSL cryptographic provider through JCA/JCE/JSSE which may provide a different selection of cryptographic algorithms and/or performance benefits relative to the SunJCE provider.
You can also use tcnative to enable the APR connector which uses OpenSSL for its cryptographic operations.

So, a possible solution would be to build tcnative with oqs-openssl?

[dstebila]

We haven't tried using it with Apache Tomcat. I don't think it will work immediately as you would probably need to update the JCA/JCE/JSSE providers to know about the relevant post-quantum algorithms and TLS parameters, even if they are getting the implementation of those algorithms from OpenSSL.

[baentsch]

I fully support your statement wrt to certificates, @dstebila : That will need serious commitment by Oracle to move to quantum-safety. Regarding KEMs, though, we have added the TLS_DEFAULT_GROUPS environment variable exactly in order to circumvent the (API/functionality) limitations caused by proprietary software like Java. This just might allow swapping in oqs-openssl for openssl and activate QSC KEMs using this variable -- even in Tomcat. @lhuynh-cs feel free to try this and let us know about your findings.

Another question, though: You state

Nginx and Apache httpd are patched to work with oqs

What patches are you referring to? Both apache httpd and nginx Dockerfiles don't contain any patches -- references to link liboqs are added, true, but does that constitute a patch?