Feature Request: Post-quantum cryptography

[0-wHiTeHand-0]

Hi, this is just a request for the medium/long-term. It would be great to start introducing post-quantum crypto similarly as Rosenpass or other projects. Quantum computers are not a threat nowadays (as far as I know), but they will be in the future.

[nbrownus]

The best method that I personally know of currently would be to use a noise variant that supports kyber768 or above. The public keys in this scheme are prohibitively large which leaves very little space for the other certificate details to fit within a single handshake packet. nebula uses a certificate that is signed by a mutually trusted authority to establish identity characteristics which benefit the built in firewall to allow assertions of traffic flow beyond a simple ip address. Supporting this would require a move to QUIC, TCP, or something else similar at the transport layer, which would introduce backwards incompatibility.

Another option would be similar to what wireguard offers, a per tunnel PSK (which is negotiated using a PSQ technique of your choice) to harden each tunnel. The main downsides is that the security of that key exchange as well as the exchange itself are left entirely up to the network operator.

We can also gain a slight edge with #1273, which provides for a mesh wide PSK to increase security, which is less beneficial than a per tunnel PQS negotiated PSK.

[Clancy508]

A third option is the OpenSSH route - use key encapsulation with a post quantum protocol. That leaves auth quantum insecure but is supposed to at least protect against capture and decrypt later type attacks.

Another solution to look into is https://rosenpass.eu/, which is the setup that Netbird uses, although that would either require significant adaptation or implementing a PSK mechanism anyway that Rosenpass can hook into

[0-wHiTeHand-0]

Just went through this NIST announcement. TL;RD conventional cryptographic algorithms should be replaced by post-quantum cryptography by 2030.
In addition to Rosenpass, another example of implementing PQC is Cloudflare's zero trust platform. They already apply ML-KEM, which is the PQ key agreement selected by NIST (it seems that kyber768 is obsolete).

[mossholderm]

Just to keep this up to date, I've seen a couple of articles today about using Merkle Tree certificates to address the cert size issue.

• Cloudflare article
• Ars Technica article

[hellrazorx64]

Do you think a cross compatibilty roll out can be possible like Rosenpass is for Netbird?