Repository navigation
Documenting how to use OpenSSL::SSL::SSLContext in PQC use cases #1118
Description
Activity
The class/module-level docs are getting outdated. I'd be very helpful if you could work on this!
BTW using multiple certificates (calling
SSLContext#add_certificatemultiple times) is a very niche use case, so I'm not so sure if it warrants a dedicated section.BTW using multiple certificates (calling
SSLContext#add_certificatemultiple times) is a very niche use case, so I'm not so sure if it warrants a dedicated section.I believe this will become more common in the future. Both Google's Chrome root CA program and Apple's root CA program have announced they will support Merkle Tree Certificates, and both Cloudflare and Letsencrypt will soon run trials to issue Merkle Tree Certificates using ACME and plan to deploy those around 2027/2028.
Many users that want to opt-in to post-quantum security with their server certificates without cutting off older clients that don't support them yet will use this, so I think this will move from a niche use case to a much more common one over the next 2-3 years.
@rhenium OK. I will work on this, and will send a PR.
I talked with OpenSSL team at my company, showing this issue ticket link. And @neverpanic helped me. For the Merkle Tree Certificates (MTC) that neverpanic mentioned, this is what I wrote a little on the Ruby ticket bellow.
https://bugs.ruby-lang.org/issues/22068#Standardization-status-for-PQC
But the future of ML-DSA is Merkle Tree Certificate (MTC)-based or public-CA. MTC is a kind of alternative of public-CA.
In my understanding, MTC is alternative of public CA, and being invented to use PQC signature algorithms such as ML-DSA and SLH-DSA. According to the Google Chrome's community to promote MTC, the existing public CA is not practical with the PQC signature algorithms that has much larger sized signatures than the current non-PQC signatures. So, supporting MTC means
https://googlechrome.github.io/chromerootprogram/crp/moving-forward-together/
Unfortunately, post-quantum keys and signatures have a fundamental problem: their size. A single post-quantum signature can be over 20 times larger than the classical cryptography signatures commonly used today (e.g., ECDSA). Considering that secure connections in Chrome often rely on more than 5 signatures and 2 public keys, attempting to use post-quantum cryptography as a "drop-in" replacement within the existing ecosystem would drastically degrade internet performance. For this reason Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store and will only do so as a last resort.
Instead, Chrome, in collaboration with other partners, is exploring a fundamental evolution of the ecosystem based on Merkle Tree Certificates (MTCs). MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs. In this model, a CA signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree.
For the following neverpanic's comment, maybe I found the following primary source references of their articles to support MTC.
Both Google's Chrome root CA program and Apple's root CA program have announced they will support Merkle Tree Certificates, and both Cloudflare and Letsencrypt will soon run trials to issue Merkle Tree Certificates using ACME and plan to deploy those around 2027/2028.
- Google: https://blog.google/security/cultivating-a-robust-and-efficient-quantum-safe-https/
- Apple: https://groups.google.com/a/chromium.org/g/ct-policy/c/QGZw2ADMXvk/m/pR3A5uRZCAAJ . This is a kind of official announcement, maybe?
- Claudflare: https://blog.cloudflare.com/bootstrap-mtc/
- Letsencrypt: https://letsencrypt.org/2026/06/03/pq-certs
Claudeflare offers RSA (non-PQC) and ECDSA (non-PQC) certificates. This is not the PQC and non-PQC. But this is the case that a vendor offers multiple certificate hosting TLS server, isn't it?
https://developers.cloudflare.com/ssl/faq/#does-cloudflare-issue-both-rsa-and-ecdsa-certificates
Q. Does Cloudflare issue both RSA and ECDSA certificates?
A. Yes. Cloudflare can issue both RSA and ECDSA certificates.Here is another clue that PQC/non-PQC signatures use case will be common in my opinion. OpenSSH 10.6 added the following PQC/non-PQC hybrid sh-mldsa44-ed25519 (ML-DSA-44 + ED25519) signature algorithm. This is not multiple signatures, but maybe OpenSSL-specific one hybrid signature algorithm which is like ML-KEM's hybrid key exchange algorithm X25519MLKEM768 (X25519 + MLKEM768). But I think this shows PQC/non-PQC multiple signatures use case will be common.
https://www.openssh.org/txt/release-10.6
- All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm.
Below is maybe the initial commit implementing the ssh-mldsa44-ed25519 feature. The commit message is useful to understand what this feature is. It seems that the
ssh-mldsa-eddsa.cis the main file.openssh/openssh-portable@81ca145
Below are the
sshd_config(SSH server config) andssh_config(SSH client config) manual documents. It seems that they addedssh-mldsa44-ed25519inCASignatureAlgorithmsconfig item in both SSH server and client config files.sshd_config(5)
https://github.com/openssh/openssh-portable/blob/V_10_6/sshd_config.5#L411-L421ssh_config(5)
https://github.com/openssh/openssh-portable/blob/V_10_6/ssh_config.5#L470-L480
The ruby/drb started to support PQC by the PR ruby/drb#62. The approach is that drb accepts
OpenSSL::SSL::SSLContextobject from users. However, drb users need to understand how to createOpenSSL::SSL::SSLContextinstance for PQC use cases. The usages are such as using#groups=to specify the key exchange algorithm with ML-KEM, and using#sigalgs=to specify signature algorithms with ML-DSA only for ML-DSA cert server, or ML-DSA/RSA for ML-DSA/RSA multiple cert server.I created the following Ruby scripts to show the examples of
OpenSSL::SSL::SSLContextin some PQC server/client cases with ML-DSA single certificate server and ML-DSA/RSA multiple certificate server.I want to document the usages of
OpenSSL::SSL::SSLContextin PQC use cases in ruby/openssl, to fill the knowledge gap, and guide users of other ruby/* libraries accepting or exposingOpenSSL::SSL::SSLContextinstance.I want to update the following generated rdoc documents, adding the PQC related contents with code examples.
#groups=,#sigalgs=#group,#sigalg,#peer_sigalgI am still considering what is the best to document this topic. What do you think? Is there a good idea about where and how to document this topic?