OpenPrinting / OpenPrinting/libcups
Support Post Quantum ML-KEM and for TLS/certificates
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 81
- Forks
- 48
- Avg merge
- 23h 58m
- Merged PRs (30d)
- 2
Description
RFC 10024 defines hybrid TLS negotiation for the post quantum ML-KEM algorithm.
A related RFC draft to support Merkle Tree Certificates is also under development to make ML-KEM certificates more reasonably-sized.
OpenSSL, LibreSSL, and GNU TLS already support ML-KEM. Not sure about the Merkle Tree certificates...
We need to support PQC in libcups 3.1, and will need to allow for both traditional and PQ algorithms for the foreseeable future:
- Update SSLOptions to support DenyRSA and DenyECC options
- Update certificate store to support multiple certificates per host (RSA/ECC + ML-KEM/MT)
- Update
_httpTLSStartto provide the right kind of certificate based on the algorithm used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading RFC 10024 and the linked Merkle Tree Certificates draft, then trace SSLOptions, the certificate store, and _httpTLSStart. The work is done when DenyRSA and DenyECC are supported, hosts can hold traditional and post-quantum certificates, and _httpTLSStart selects the appropriate certificate algorithm.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100