10. TLS/mTLS Communication

Scenarios: 4
FFI Functions: ~30
Status: ⏳ Planned

This category covers all scenarios for Post-Quantum secure TLS communication. Server setup, client configuration, and mTLS deployment.

Scenarios

ID Scenario Description Complexity Status
10.1 TLS Server Setup Server with PQ certificate ⭐⭐⭐ ⏳
10.2 TLS Client Configuration Client for PQ-TLS ⭐⭐⭐ ⏳
10.3 mTLS Deployment Mutual authentication ⭐⭐⭐⭐ ⏳
10.4 Hybrid TLS ECDHE + ML-KEM Key Exchange ⭐⭐⭐⭐ ⏳

TLS 1.3 with PQ Key Exchange

sequenceDiagram participant C as Client participant S as Server Note over C,S: TLS 1.3 Handshake with Hybrid Key Exchange C->>S: ClientHello (x25519_mlkem768) Note right of C: ECDH + ML-KEM Key Shares S->>C: ServerHello (x25519_mlkem768) S->>C: EncryptedExtensions S->>C: Certificate (ML-DSA-65) S->>C: CertificateVerify S->>C: Finished Note over C: Validate certificate Note over C: Calculate hybrid key C->>S: Finished Note over C,S: 🔐 Encrypted Communication

Cipher Suites

Cipher Suite Key Exchange Authentication Encryption
TLS_AES_256_GCM_SHA384 x25519_mlkem768 ML-DSA-65 AES-256-GCM
TLS_CHACHA20_POLY1305_SHA256 x25519_mlkem768 ML-DSA-65 ChaCha20-Poly1305
TLS_AES_256_GCM_SHA384 x25519 (Hybrid fallback) ECDSA P-384 AES-256-GCM

Server Configuration

Server Configuration PQ Support
Nginx ssl_certificate + ssl_protocols Via OpenSSL 3.6
Apache SSLCertificateFile + SSLProtocol Via OpenSSL 3.6
Kestrel (.NET) HttpsConnectionAdapterOptions Native
HAProxy bind … ssl crt Via OpenSSL 3.6

Industry-Specific Requirements

Industry TLS Requirements Special Features
Energy/SCADA TLS 1.2+ IEC 62351, Offline fallback
Healthcare TLS 1.3 gematik TI Connector
Automotive TLS 1.3 V2X, short handshakes
Industry 4.0 TLS 1.3 + mTLS OPC UA Security

Quick Start Code

Kestrel Server (ASP.NET Core)

// Program.cs
var builder = WebApplication.CreateBuilder(args);
 
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(443, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            // Load PQ certificate
            var cert = ctx.LoadCertificate("server.crt.pem");
            var key = ctx.LoadPrivateKey("server.key.pem", password);
            httpsOptions.ServerCertificate = ctx.CreateX509Certificate2(cert, key);
 
            // Enforce TLS 1.3
            httpsOptions.SslProtocols = SslProtocols.Tls13;
 
            // Client certificate for mTLS
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
            httpsOptions.ClientCertificateValidation = (cert, chain, errors) =>
            {
                return ctx.ValidateCertificate(cert, trustStore).IsValid;
            };
        });
    });
});

HttpClient with PQ-TLS

// Configure HttpClient for PQ-TLS
var handler = new SocketsHttpHandler
{
    SslOptions = new SslClientAuthenticationOptions
    {
        EnabledSslProtocols = SslProtocols.Tls13,
        RemoteCertificateValidationCallback = (sender, cert, chain, errors) =>
        {
            // PQ certificate validation
            return ctx.ValidateCertificate(cert, trustStore).IsValid;
        }
    }
};
 
var httpClient = new HttpClient(handler);
var response = await httpClient.GetAsync("https://pq-server.example.com/api/data");

OpenSSL 3.6 Configuration

# /etc/ssl/openssl.cnf
 
[openssl_init]
providers = provider_sect
 
[provider_sect]
default = default_sect
oqsprovider = oqsprovider_sect
 
[default_sect]
activate = 1
 
[oqsprovider_sect]
activate = 1
module = /usr/lib/ossl-modules/oqsprovider.so
Category Relationship
3. Issue Certificates Server certificates
9. Authentication mTLS Client Auth
7. Encryption Key Exchange

« ← 9. Authentication | ↑ Scenarios | 11. Key Management → »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional

, , , ,