Add TLS 1.3 group information to various SSL/TLS methods and classes
- Dominant language
- C#
- Stars
- 18.3k
- Forks
- 5.6k
- PR merge metrics
- PR metrics pending
Description
As we move toward post quantum crypto, selecting and/or detecting hybrid TLS 1.3 groups (ie; Eliptic Curve Crypto [ECC] + MLKEM) is paramount.
Today, this data is *not* exposed through various .NET methods, such as the ASP.NET code below.
```csharp
app.MapGet("/", (HttpContext ctx) =>
{
var tls = ctx.Features.Get();
return Results.Json(new
{
Protocol = tls?.Protocol.ToString() ?? "Unknown",
CipherSuite = tls?.NegotiatedCipherSuite?.ToString() ?? "Unknown"
});
});
```
An update would include some like this:
```csharp
CipherGroup = tls?.NegotiatedGroup?.ToString() ?? "Unknown"
```
This would require additional pub enums that include the group value:
```csharp
public enum TlsSupportedGroup : ushort
{
// Classical ECDHE (RFC 8446 §4.2.7, RFC 8422).
secp256r1 = 0x0017, // NIST P-256
secp384r1 = 0x0018, // NIST P-384
x25519 = 0x001D, // RFC 7748
// Hybrid ECDHE + ML-KEM (draft-kwiatkowski-tls-ecdhe-mlkem).
SecP256r1MLKEM768 = 0x11EB,
X25519MLKEM768 = 0x11EC,
SecP384r1MLKEM1024 = 0x11ED,
}
```
This list is *not* complete, but I doubt you want the entire list; it runs to about 100-ish values.
For bonus points; the following would be useful:
```
IsHybrid() - classic AND MLKEM
IsPostQuantum() - MLKEM OR IsHybrid()
IsPurePostQuantum() - MLKEM
IsClassic() - classic
```
Note: the group is negotiated separately from the ciphersuite in TLS 1.3.
If you want more info - just ask.
Contributor guide
Assessment
This issue has not been assessed yet.