Hi, > The website says OpenXPKI plans to support Post-Quantum Cryptography, but I > can't find anything concrete in the docs. The certificate profile only allows > rsa, ec and dsa as key algorithms, and I see no PQC entries in the CHANGELOG. > Two questions: > • Is it possible today to issue certificates with ML-DSA (FIPS 204), for > example using OpenSSL 3.5? If yes, how should the profile be configured? > • Is PQC support on the roadmap? Is there a target release?
As you are probably aware, PQC standardization is still in the process of getting finalized, and the outcome (at least for PQ/T composite mechanisms) is still not entirely foreseeable. This means we still have to adapt our PQC roadmap along the way. So far, we are currently actively working on the PQ integration, and we have basic PQC support running in our lab which uses liboqs/oqsprovider for PQC support. The straightforward approach works fine in our tests. Nevertheless we will start rolling out PQC support in OpenXPKI's Enterprise Edition first in order to respond to the needs of our customers as fast as possible. For the Enterprise Edition, we are currently also working on PKCS#11 3.2 PQC support and corresponding HSM integration. If you are considering PQC for your PKI or planning for PQ migration, consider contacting our team at White Rabbit Security for professional services. The PQC release date as well as details regarding the feature set of the Community Edition is not settled yet but will be announced on the mailing list within the course of Q4. For more details feel free to contact us off-list to discuss options. Cheers Martin _______________________________________________ OpenXPKI-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-users
