LibOQS .NET inquiry

[openforge-kt]

Hello folks,

My name is Kamal Tufekcic, and I'm the co-founder of OpenForge.

We're developing a comprehensive .NET wrapper for liboqs (OpenForge.Cryptography.LibOqs - not published just yet) that fully utilizes everything LibOQS provides (stateful signatures are a WIP), with cross platform support for Windows (ARM and x64), Linux (arm64, arm64-musl, x64, x64-musl, riscv64 and riscv64-musl eventually, compiling for them is fine, but testing them in CI is complicated), and MacOS (arm64), and I would like to ask for permission to use liboqs.net for documentation website.

This would:

• Clearly serve the .NET community specifically,
• Include prominent attribution to your project - as this is just documentation, there would be many references to your project and repository, and you are also included already in our LICENSE.md
• Help expand post-quantum crypto adoption in .NET ecosystem - currently the only option for the most part is BouncyCastle, and they are not exactly up to date with PQC, and they mostly prioritize Java,
• Be transferable to you if you ever desired, in any way you'd like, I'd even be fully willing to transfer the entire repository to your ownership if you'd like,

If that domain is a bit too much, and you don't want it to seem as if this is official (which would be absolutely understandable), my second choice is liboqs.openforge.sh, a lot less "official" but still uses 'liboqs', so I'd still like your permission (or lack thereof) before proceeding with any decisions.

All the code, unit testing, and documentation are completely done, and, if you don't have any complaints about the naming, the NuGet repository as well under the name mentioned above.

Would you be open to discussing this?

EDIT: ignore the liboqs.net part, since I first asked in Discord, someone already purchased the domain

[dstebila]

Tagging @open-quantum-safe/tsc and @open-quantum-safe/liboqs-committers to solicit input.

[openforge-kt]

If anyone is willing to review, the repository is public (NuGet packages aren't published yet until this discussion is concluded) github.com/openforge-sh/liboqs-dotnet and I temporarily deployed the documentation page: https://liboqs.openforge.sh/

For some additional context/assurance, this is far from the final state of things. I'm currently working on moving from dynamic libs to static, alongisde adding support for android, ios, and riscv, and updating the pipeline to 1. simplify the egregiously overengineered build process, and 2. add testing for all (or at least as many as reasonably achievable) supported platforms. Until this is done I don't intend to publish the NuGet package. The roadmap beyond that is just adding stateful signature support, and then just staying aligned with native library updates

[baentsch]

Hello @openforge-kt , thanks very much for touching base and of course, for your work supporting the open source idea in general and OQS in particular!

I'm no expert on dotnet (neither technically nor from an ecosystem perspective), so please take my questions with this in mind:

• How is your work different from the stuff that is in https://github.com/open-quantum-safe/liboqs-dotnet ?
• Is there a community waiting for/needing this? The reason for asking: We discontinued the above sub project because of lack of interest (both to use as well as to maintain).
• Are you willing to maintain this code going forward? Are more people than yourself working on this? The GH link on your web site is returning 404, unfortunately, so I couldn't check myself (or if just a permissions question, please give myself view rights)
• Would you be willing to present your work (and answer these and probably more questions) in one of the regular OQS status meetings (see Tuesdays on https://pqca.org/calendar/)?

[openforge-kt]

1. It's more modern, supports .net8, .net9, .net10 has been tested and validated, but won't be officially supported until it's out of RC state, it supports all KEM and SIG algorithms (apart from BIKE on Windows), and has all the core utils from liboqs (safe memory management, validation, etc). It also has options to use cut down libraries, if someone only needs KEM operations, they don't need to pull the entire lib. They can pull only KEM or only SIG operations. It'll also, as mentioned in the earlier message, support all platforms

2. I can't guarantee that there is a community waiting for it, but I can say that the only real option for PQC in .NET is https://www.nuget.org/packages/BouncyCastle.Cryptography/ which is fairly out of date compared to their Maven package, they don't keep them synced too well, it's poorly documented, and it still has over 160M downloads. Aside from all that, I plan to build a lot of different things using this lib (initially this was embedded in my project, but then I realized I might as well make this public). I tried using BouncyCastle for my project, and it was... not a fun experience, so in my opinion, aside from my company, there should be a reasonable demand for this.

3. Yes, absolutely, as mentioned above, I intend to use this for most projects I have planned for my company, all using this, so aside from just wanting to make this available to people, it's also in my best interest to keep this up to date with the source lib. There are more people in my company, but I'd be the only one maintaining this. Regarding the URL, I think it was a bad copy paste, for some reason it turned it into an HTTP URL instead of HTTPS: https://github.com/openforge-sh/liboqs-dotnet.

4. Absolutely, that time works very well for my timezone, so I can join whenever you want me to, even today if that's alright with you.

And thank you for everything you've done for PQC!

[baentsch]

Thanks for the feedback, updated links and willingness to share more in person. I'm not sure today is the best day to give proper exposure to your work as the agenda has already been sent out. But you're surely cordially welcome to already today drop by, quickly introduce yourself and just listen in for a start should the other topics take up all time.

Some feedback on the GH repo in advance, if OK:

• This looks all very new code indeed -- and I have some heartburn when then reading statements like

This library offers production-ready implementations of NIST-standardized post-quantum algorithms to protect against both classical and quantum computing threats.

all the while this is based on liboqs -- which explicitly discourages such usage.

• I'm missing a "how to build this" section as well as CI testing it: Am I overlooking something?
• Generally, the project page looks quite a bit like a marketing page, not so much one geared to help contributors understand the project, would you agree?
• The Contributing section is confusing me: It doesn't say explicitly how to achieve the properties listed there: Where should one look?
• Also, I'm not sure I understand how to install this (but maybe this is due to my lack of understanding of dotnet): If running the commands listed (dotnet add package OpenForge.Cryptography.LibOqs), a full GH checkout happens as well as a "behind-the-scenes" build-and-install of this code? How would one contribute local changes back then?

Please accept my apologies for any bluntness above that may be borne out of ignorance how to work with dotnet. Maybe @christianpaquin can chime in with some more dotnet/Windows knowledge.

Last comment: I'm slightly confused when you refer to "your company": Are you working at OpenForge or somewhere else (openforge.sh did not resolve)?

[openforge-kt]

Thank you for the invite, I'd be very happy to attend, and curious to learn more.

As for your bluntness, no need for apologies, it's very much justified for the most part.

1. Regarding the build, and also the .md files in general, these can be seen more as guidelines/templates, I think I forgot to mention this here, I only mentioned it in the email with Douglas, the .md files are still being worked on (lots of unpushed changes), what you see currently is 100% AI generated slop, none of us at the company are very good at showing off our work in any reasonable way, so we figured we'd just throw AI at it, but rest assured, it will be rewritten, it also references some features that I was working on but since removed (stateful signatures for example) because I wasn't happy with the implementation (mine in C#, not yours).

2. While the docs don't mention it, the way to build it is the build script in the repo, and the CI testing is in the pipeline config. The pipeline builds liboqs from latest commit for multiple platforms, packages it in a way the code is configured to load, and .NET automatically uses the .so files based on target platform (or native platform if none specified). Though as mentioned, this process will be rewritten shortly to reduce complexity and add additional platform support.

3. While this is as mentioned earlier boilerplate/AI slop, I think this is fairly straightforward. The unit tests are in the tests/ directory, XML docs are the /// comments you see on all the classes methods and variables in src/, docfx is a tool that automatically creates API docs from those summary comments (that's what made liboqs.openforge.sh, this was entirely made from code comments, nothing else). Maybe I'm misunderstanding you, if so, please let me know what specifically is unclear there.

4. This relates what I mentioned earlier - dotnet automatically picks the relevant .so files that were provided during initial build in CI, the last section in the config file (the commented out one) is what will push this built library to NuGet as a package, when a user on linux-x64 platform runs "dotnet add OpenForge.Cryptography.LibOqs.KEM", it will only pull the library from runtimes-kem/linux-x64/native (the compiled lib gets placed here during CI, then when the build is run, tests pass, and the lib gets published, dotnet/NuGet automatically handle the platform). The CI also generates code coverage reports, which are bundled with existing API docs by docfx, and are automatically deployed from "docs" branch (this is deployed in a very different way). Anyone making a contribution would open an MR, if it's merged in, it would automatically get deployed to NuGet and become available for users. Obviously there would be more details required when this is actually ready for use, such as staging/dev branch, better readmes, etc.

As for the last comment, yes, I work at OpenForge, but not .io - no relation. This is a new company started somewhat recently, I'd be happy to share more about it, but I doubt you want to be bored by the details (do let me know if I'm mistaken), but our ethos is centered around OSS, every piece of our infrastructure runs on it, and everything we build will be it, from GNU Taler as payment processor, to BIND9 as DNS server. As for the website, well, that's a sad story relating to my first point - we suck at creative/marketing writing, and we have absolutely no idea what to put as our website, we're looking for some creative people/writers to compensate for our... lack of creativity let's call it. We're a team of 3 people, and all 3 of us are backend developers terrified of CSS and writing.

Let me know if you have any other questions. I'm well aware this is not exactly confidence inspiring, and as I mentioned to Douglas, if you don't want to have any association with us, that would be completely understandable and justifiable, while we'd love to be part of the community, we don't want to negatively impact your reputation/credibility by associating you with someone who has no reputation. That's why we initially just asked if you're okay with us using LibOqs in the NuGet package name and subdomain name for the docs site, or if we should go with something else/more generic.