hashicorp / hashicorp/consul

Support of post-quantum algorithms

Open
#23,738 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

Post-quantum algorithms are getting more and more traction from a technical (RFCs, actual adoption [1], support in common implementations [2]) and regulatory standpoint (ANSSI timeline in France, US Government recommendations,…).

Consul should begin supporting post quantum algorithms such as X25519MLKEM768 for TLS key exchange (requires TLS 1.3).

If I understand correctly, TLS implementation in Consul is delegated to the tlsutil package which in turn depends on crypto/tls.

Golang does support post quantum algorithms in crypto/tls since 1.24 (https://go.dev/pkg/crypto/tls/), so Consul might already support these algorithms, but if so IMHO the documentation should reflect that.

[1] https://radar.cloudflare.com/post-quantum

[2] among others, https://openssl.foundation/news/the-features-of-3-5-post-quantum-cryptography

#### Use Case(s)

Consul TLS endpoint for KV, API Gateway,…

Contributor guide

Open the contributing guide

Research direction

Start by tracing Consul's TLS handling through the tlsutil package and Go's crypto/tls support for TLS 1.3. Check whether X25519MLKEM768 is already available in the supported Go versions, then determine whether the issue requires implementation, configuration, or documentation. Done should mean a clearly scoped and validated support or documentation change.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.