Releases: open-quantum-safe/oqs-provider
0.5.1
oqs-provider 0.5.1
About
The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography. More information on OQS can be found on our website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.
oqs-provider is a standalone OpenSSL 3 provider enabling liboqs-based quantum-safe and hybrid key exchange for TLS 1.3, as well as quantum-safe and hybrid X.509 certificate generation, CMS and dgst operations.
When deployed, the oqs-provider binary (shared library) thus adds support for quantum-safe cryptographic operations to any standard OpenSSL(v3) installation.
In general, the oqs-provider main branch is meant to be useable in conjunction with the main branch of liboqs and the master branch of OpenSSL.
Further details on building, testing and use can be found in README.md. See in particular limitations on intended use.
Release notes
This is version 0.5.1 of oqs-provider.
Security considerations
None.
What's New
This release continues from the 0.5.0 release of oqs-provider and is fully tested to be used in conjunction with the main branch of liboqs. This release is guaranteed to be in sync with v0.8.0 of liboqs.
This release also makes available for the first time ready-to-run binaries for Windows (.dll) and MacOS (.dylib) compiled for x64 CPUs. Activation and use is documented in USAGE.md.
Additional new feature highlights
- Support for Windows platform
- Added
brewsupport for MacOS - Documentation restructured supporting different platforms
- Enable statically linkable oqsprovider
What's Changed (full commit list)
- trigger oqs-demos build when pushing to main by @baentsch in #182
- Enable building on platforms without _Atomic support by @baentsch in #183
- Standalone ctest by @baentsch in #184
- Convert oqs-kem-info.md code points to hex by @WillChilds-Klein in #188
- Documentation update by @baentsch in #187
- Add full Windows support by @baentsch in #192
- Improve installation by @baentsch in #196
- document specs [skip ci] by @baentsch in #190
- Add .DS_Store (macOS), .vscode (visual studio code), and .idea (Jetbr… by @planetf1 in #200
- first test for macos CI by @baentsch in #198
- Add brew to preinstall test matrix by @baentsch in #205
- General documentation overhaul by @baentsch in #204
- change TLS demo to use QSC alg [skip ci] by @baentsch in #208
- Build a module instead of a shared library. by @thb-sb in #207
- explain groups in USAGE [skip ci] by @baentsch in #214
- ensure OpenSSL3 is linked to liboqs during script build by @baentsch in #212
- Remove trailing whitespaces in generated code. by @thb-sb in #215
- Fix a minor bug in the
runtests.sh. by @thb-sb in #216 - Specify version
3.1while installing OpenSSL using brew. by @thb-sb in #217 - Allow the user to build oqs-provider as a static library. by @thb-sb in #201
- Add a line to
RELEASE.mdto highlight the support for static libraries by @thb-sb in #220 - Enhance github bug report template by @baentsch in #219
- Use OpenSSL 3 if available to build liboqs on CircleCI/macOS. by @thb-sb in #222
- Fix a bug in the CMake script. by @thb-sb in #221
New Contributors
- @WillChilds-Klein made their first contribution in #188
- @planetf1 made their first contribution in #200
- @thb-sb made their first contribution in #207
Full Changelog: 0.5.0...0.5.1
Contributors
Assets 5
v0.5.0
This release continues from the 0.4.0 release of oqs-provider and is fully tested to be used in conjunction with the main branch of liboqs. This release is guaranteed to be in sync with v0.8.0 of liboqs.
oqs-provider now also enables use of QSC algorithms during TLS1.3 handshake. The required OpenSSL code updates are contained in openssl/openssl#19312.
Algorithm updates
All algorithms no longer supported in the NIST PQC competition and not under consideration for standardization by ISO have been removed. All remaining algorithms with the exception of McEliece have been lifted to their final round 3 variants as documented in liboqs. Most notably, algorithm names for Sphincs+ have been changed to the naming chosen by its authors.
Functional updates
- Enablement of oqs-provider as a (first) dynamically fetchable OpenSSL3 TLS1.3 signature provider.
- MacOS support
- Full support for CA functionality
- Algorithms can now be selected by their respective bit strength using the property string "oqsprovider.security_bits"
- Documentation of (O)IDs used by the different PQC algorithms used and supported in current and past releases of oqs-openssl and oqs-provider
- Testing is now completely independent of a source code distribution of OpenSSL being available
- oqsprovider can be built and installed making use of pre-existing installations of
OpenSSLandliboqs. Details are found in the "scripts" directory's build and test scripts. - Automated creation of (Debian) packaging information
- Graceful handling (by way of functional degradation) of the feature sets contained in different OpenSSL releases; all oqsprovider capabilities are only available when using a version > than OpenSSL3.1.
- A bug regarding handling of hybrid algorithms has been fixed as well as some memory leaks.
Misc updates
- Dynamic code point and OID changes via environment variables. See ALGORITHMS.md.
- Dynamic key encoding changes via environment variable using external qsc_key_encoder library. See ALGORITHMS.md.
Full Changelog: 0.4.0...0.5.0.
v0.4.0
oqs-provider 0.4.0
About
The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography. More information on OQS can be found on our website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.
oqs-provider is a standalone prototype OpenSSL 3 provider enabling liboqs-based quantum-safe and hybrid key exchange for TLS 1.3, as well as quantum-safe and hybrid X.509 certificate generation, CMS ond dgst operations.
When deployed, the oqs-provider binary (shared library) thus adds support for quantum-safe cryptographic operations to any standard OpenSSL(v3) installation.
In general, the oqs-provider main branch is meant to be useable in conjunction with the main branch of liboqs and the master branch of OpenSSL.
Further details on building, testing and use can be found in README.md. See in particular limitations on intended use.
Release notes
This is version 0.4.0 of oqs-provider.
Security considerations
This release removes Rainbow level 1 and all variants of SIDH and SIKE due to cryptanalytic breaks of those algorithms. Users are advised to move away from use of those algorithms immediately.
What's New
This release continues from the 0.3.0 release of oqs-provider and is fully tested to be used in conjunction with version 0.7.2 of liboqs.
oqs-provider has been integrated as an external test component for OpenSSL3 testing and will thus remain in line with any possibly required provider API enhancements.
Algorithm updates
- Removal of SIKE/SIDH and Rainbow level I due to cryptographic breaks
Functional updates
- Addition of quantum-safe CMS operations via the OpenSSL interface
- Addition of quantum-safe dgst operations via the OpenSSL interface
Misc updates
- Additional testing
- Integration with and of OpenSSL test harness
Full Changelog: 0.3.0...0.4.0.
v0.3.0
0.3.0 - January 2022
About
This is the first official release of oqsprovider, a plugin/shared library making available quantum safe cryptography (QSC) to OpenSSL (3) installations via the provider API.
This project is part of the Open Quantum Safe (OQS) project: More information on OQS can be found on our website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.
Release Notes
The current feature set of oqsprovider comprises
- support of all QSC KEM algorithms contained in liboqs (v.0.7.1) including hybrid classic/QSC algorithm pairs
- integration of all QSC KEM algorithms into TLS 1.3 using the groups interface
- support of all QSC signature algorithms contained in liboqs (v.0.7.1) including hybrid classic/QSC algorithm pairs
- integration for persistent data structures (X.509) of all QSC signature algorithms using the standard OpenSSL toolset
Limitations
- This code is not meant to be used in productive deployments
- Currently, only Linux is supported and only Ubuntu 20/x64 is tested
- Full TLS1.3 support for QSC signatures is missing (see openssl/openssl#10512)