10. TLS/mTLS Kommunikation

Szenarien: 4
FFI-Funktionen: ~30
Status: ⏳ Geplant

Diese Kategorie umfasst alle Szenarien zur Post-Quantum-sicheren TLS-Kommunikation. Server-Setup, Client-Konfiguration und mTLS-Deployment.

Szenarien

ID	Szenario	Beschreibung	Komplexität	Status
10.1	TLS-Server einrichten	Server mit PQ-Zertifikat	⭐⭐⭐	⏳
10.2	TLS-Client konfigurieren	Client für PQ-TLS	⭐⭐⭐	⏳
10.3	mTLS Deployment	Beidseitige Authentifizierung	⭐⭐⭐⭐	⏳
10.4	Hybrid-TLS	ECDHE + ML-KEM Key Exchange	⭐⭐⭐⭐	⏳

TLS 1.3 mit PQ Key Exchange

sequenceDiagram participant C as Client participant S as Server Note over C,S: TLS 1.3 Handshake mit Hybrid Key Exchange C->>S: ClientHello (x25519_mlkem768) Note right of C: ECDH + ML-KEM Key Shares S->>C: ServerHello (x25519_mlkem768) S->>C: EncryptedExtensions S->>C: Certificate (ML-DSA-65) S->>C: CertificateVerify S->>C: Finished Note over C: Zertifikat validieren Note over C: Hybrid Key berechnen C->>S: Finished Note over C,S: 🔐 Verschlüsselte Kommunikation

Cipher Suites

Cipher Suite	Key Exchange	Authentication	Encryption
TLS_AES_256_GCM_SHA384	x25519_mlkem768	ML-DSA-65	AES-256-GCM
TLS_CHACHA20_POLY1305_SHA256	x25519_mlkem768	ML-DSA-65	ChaCha20-Poly1305
TLS_AES_256_GCM_SHA384	x25519 (Hybrid fallback)	ECDSA P-384	AES-256-GCM

Server-Konfiguration

Server	Konfiguration	PQ-Support
Nginx	ssl_certificate + ssl_protocols	Via OpenSSL 3.6
Apache	SSLCertificateFile + SSLProtocol	Via OpenSSL 3.6
Kestrel (.NET)	HttpsConnectionAdapterOptions	Native
HAProxy	bind … ssl crt	Via OpenSSL 3.6

Branchenspezifische Anforderungen

Branche	TLS-Anforderung	Besonderheiten
Energie/SCADA	TLS 1.2+	IEC 62351, Offline-Fallback
Healthcare	TLS 1.3	gematik TI-Konnektor
Automotive	TLS 1.3	V2X, kurze Handshakes
Industrie 4.0	TLS 1.3 + mTLS	OPC UA Security

Code-Schnellstart

Kestrel Server (ASP.NET Core)

// Program.cs
var builder = WebApplication.CreateBuilder(args);
 
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(443, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            // PQ-Zertifikat laden
            var cert = ctx.LoadCertificate("server.crt.pem");
            var key = ctx.LoadPrivateKey("server.key.pem", password);
            httpsOptions.ServerCertificate = ctx.CreateX509Certificate2(cert, key);
 
            // TLS 1.3 erzwingen
            httpsOptions.SslProtocols = SslProtocols.Tls13;
 
            // Client-Zertifikat für mTLS
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
            httpsOptions.ClientCertificateValidation = (cert, chain, errors) =>
            {
                return ctx.ValidateCertificate(cert, trustStore).IsValid;
            };
        });
    });
});

HttpClient mit PQ-TLS

// HttpClient für PQ-TLS konfigurieren
var handler = new SocketsHttpHandler
{
    SslOptions = new SslClientAuthenticationOptions
    {
        EnabledSslProtocols = SslProtocols.Tls13,
        RemoteCertificateValidationCallback = (sender, cert, chain, errors) =>
        {
            // PQ-Zertifikatsvalidierung
            return ctx.ValidateCertificate(cert, trustStore).IsValid;
        }
    }
};
 
var httpClient = new HttpClient(handler);
var response = await httpClient.GetAsync("https://pq-server.example.com/api/data");

OpenSSL 3.6 Konfiguration

# /etc/ssl/openssl.cnf
 
[openssl_init]
providers = provider_sect
 
[provider_sect]
default = default_sect
oqsprovider = oqsprovider_sect
 
[default_sect]
activate = 1
 
[oqsprovider_sect]
activate = 1
module = /usr/lib/ossl-modules/oqsprovider.so

Kategorie	Beziehung
3. Zertifikate ausstellen	Server-Zertifikate
9. Authentifizierung	mTLS Client-Auth
7. Verschlüsselung	Key Exchange