PQC in OpenSSL Library
summary
OpenSSL 3.5 (released 8 April) adds NIST-aligned post‑quantum primitives and integration: FIPS 203/204/205 support, ML‑KEM default key share for TLS‑1.3, MLDDSA for CA and signatures with SLHDSA as a slower backup. Demos show CLI and EVP API flows for keygen, encapsulate/decapsulate and sign/verify, a TLS client/server successfully negotiating ML‑KEM, and measured encapsulation throughput around 14,000 ops/sec. Also adds FIPS provider jitter entropy, opaque EVP keys, multiple TLS key shares and QUIC bindings (msquic, Cloudflare).
AI-written summary · about
chapters (13)
- 0:00Introduction to post-quantum cryptography in OpenSSL
- 1:47OpenSSL 3.5 additions
- 3:39Why PQC matters
- 6:34PQC approaches and standards
- 8:25ML-KEM, ML-DSA, SLH-DSA in OpenSSL
- 10:37Hands-on: ML-DSA certs
- 13:23Testing TLS with PQC
- 14:32Signing with PQC certs
- 17:04Code demo: ML-KEM KEM
- 22:54Code demo: ML-DSA sign/verify
- 26:13Summary of PQC features
- 28:02Future plans and community
- 29:25Q&A: Hybrid mechanisms
related talks
59mPost-quantum cryptography for .NET developers
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
47mQuantum-Safe TLS in Practice With Open Quantum Safe & OpenSSL 3
29mIntegrating PQC in OpenSSL & Firefox via Loadable Modules for Cryptographic Agility
38mA Quantum Computing Talk Without Qubits
51mJava and Post-Quantum Cryptography
46mFrom Theory to Practice: Real-World Lessons in Post-Quantum Cryptography Migration
29mPQC Standardization at the Internet Engineering Task Force (IETF)