====== 5.2 TLS 1.3 s PQ algoritmima ======

Konfiguracija transportne enkripcije.

===== Podržani algoritmi =====

^ Funkcija ^ Algoritam ^ NIST standard ^
| Key Exchange | ML-KEM-768((FIPS 203 (ML-KEM): https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf)) | FIPS 203 |
| Potpis | ML-DSA-65((FIPS 204 (ML-DSA): https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf)) | FIPS 204 |
| Rezervni potpis | SLH-DSA((FIPS 205 (SLH-DSA): https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf)) | FIPS 205 |

===== TLS 1.3 =====

Transport Layer Security 1.3((IETF RFC 8446 (TLS 1.3): https://datatracker.ietf.org/doc/html/rfc8446)) je aktualna verzija protokola enkripcije za sigurnu mrežnu komunikaciju.

===== Hibridni način =====

Za prijelazno razdoblje: Klasično + PQ kombinirano((IETF Hybrid Key Exchange: https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/)).

<code>
Key Exchange: X25519((Curve25519: https://cr.yp.to/ecdh.html)) + ML-KEM-768
Potpis: ECDSA + ML-DSA-65
</code>

===== .NET konfiguracija =====

<code csharp>
builder.WebHost.ConfigureKestrel(options =>
{
    options.ConfigureHttpsDefaults(https =>
    {
        https.SslProtocols = SslProtocols.Tls13;
        https.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
    });
});
</code>

===== Cipher Suites =====

Preporučeni TLS 1.3 Cipher Suites((IANA TLS Cipher Suites: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4)) s PQ:

<code>
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
</code>

===== Validacija =====

<code bash>
# Test TLS veze
openssl s_client -connect gateway.intern:443 -tls1_3
</code>

===== PQ-Crypto biblioteka =====

Za programsku implementaciju PQ Key Exchangea pogledajte:

  * [[..:..:..:pqcrypt:api:wvds-system-security-cryptography:keyexchange:start|KeyExchange Namespace (ML-KEM)]]
  * [[..:..:..:pqcrypt:api:wvds-system-security-cryptography:keyderivation:keyderivationextensions|TLS 1.3 Key Derivation]]
  * [[..:..:..:pqcrypt:konzepte:algorithmen|Algoritmi (ML-KEM, ML-DSA)]]

===== Izvori =====

  * [[https://datatracker.ietf.org/doc/html/rfc8446|RFC 8446: TLS 1.3]]
  * [[https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf|FIPS 203 (ML-KEM)]]
  * [[https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf|FIPS 204 (ML-DSA)]]
  * [[https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf|FIPS 205 (SLH-DSA)]]
  * [[https://www.openssl.org/docs/man3.0/man1/openssl-s_client.html|OpenSSL s_client dokumentacija]]