Re: [Pqc] PQC X.509 115 Hackathon

[Michael Baentsch <[e-mail]>]

Am 13.10.22 um 13:18 schrieb [e-mail]:
>
> Hi LAMPS and people interested in PQC!
>
> As suggested at 114, my colleague John Gray and I would like to do a 
> 115 Hackathon on PQ keys and signatures in X.509 / PKIX.
>
> We are suggesting to play with Dilithium, Falcon, Sphincs+, and 
> Composite signing algorithms in Certs, CRLs, CSRs, PKCS#12s, CMS 
> SignedData, maybe OCSP Responses, maybe Timestamping, maybe CMP. We 
> can bring: the Entrust Toolkit (which we can hack at), Bounce Castle, 
> OpenQuantumSafe-openssl, OpenCA (easier if Max Pala is there, but we 
> can probably figure out how to build it).
>
> The point of the hackathon, I think, is going to be OIDs, and public 
> key / private key formats (ex.: the differences between Dilithium and 
> Falcon encodings in draft-uni-qsckeys, and 
> draft-massimo-lamps-pq-sig-certificates).
>
> Question 1: are others interested in joining us at the hackathon? (no 
> point is signing up for a hackathon spot if we’re the only ones there)
>
> Question 2: whether or not you're joining, what PQ X.509 / PKIX things 
> would you like to see working with Dilithium, Falcon, Sphincs+, Composite?
>
> ---
> Mike Ounsworth
> Software Security Architect, Entrust
>
The above is a great initiative that we understand to be a bit late to 
voice support for. So please take the below as a statement of interest 
and FWIW & FYI:

Q2: oqsprovider is an OpenSSL3 provider plugin able to support plain and 
composite PQ algorithms. It aims to  provide interoperability at all 
levels of TLS(1.3) without the need to fork OpenSSL. It has been 
especially equipped to support interop testing at various levels: See 
mechanisms supported at 
https://github.com/open-quantum-safe/oqs-provider/blob/main/ALGORITHMS.md

Build information: 
https://github.com/open-quantum-safe/oqs-provider#building-and-testing----quick-start 


Use information: https://github.com/open-quantum-safe/oqs-provider#using

Ready-made docker image at 
https://hub.docker.com/repository/docker/openquantumsafe/oqs-ossl3

Q1: If necessary, I'd be glad to lend a (remote) hand to anyone 
interested in using this at a hackathon. But then again, X.509 interop 
testing should be directly possible by using the standard OpenSSL 
commands. Samples at 
https://github.com/open-quantum-safe/oqs-provider#signing-data

As far as "live" PQ-X.509 certificates are concerned, a final FYI 
pointing to https://test.openquantumsafe.org: This site has been set up 
quite some time ago to facilitate ongoing & open interop testing for all 
PQ/hybrid algorithms in the NIST competition. It also has been used to 
check proper oqsprovider operation.

Regards,

--Michael