Support of post-quantum algorithms
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
#### Feature Description
Post-quantum algorithms are getting more and more traction from a technical (RFCs, actual adoption [1], support in common implementations [2]) and regulatory standpoint (ANSSI timeline in France, US Government recommendations,…).
Consul should begin supporting post quantum algorithms such as X25519MLKEM768 for TLS key exchange (requires TLS 1.3).
If I understand correctly, TLS implementation in Consul is delegated to the tlsutil package which in turn depends on crypto/tls.
Golang does support post quantum algorithms in crypto/tls since 1.24 (https://go.dev/pkg/crypto/tls/), so Consul might already support these algorithms, but if so IMHO the documentation should reflect that.
[1] https://radar.cloudflare.com/post-quantum
[2] among others, https://openssl.foundation/news/the-features-of-3-5-post-quantum-cryptography
#### Use Case(s)
Consul TLS endpoint for KV, API Gateway,…
Contributor guide
Research direction
Start by tracing Consul's TLS handling through the tlsutil package and Go's crypto/tls support for TLS 1.3. Check whether X25519MLKEM768 is already available in the supported Go versions, then determine whether the issue requires implementation, configuration, or documentation. Done should mean a clearly scoped and validated support or documentation change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cryptography, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100