W 12: Making an HTTPS Server with Post-Quantum Cryptography (10 pts extra)

What You Need

• A local virtual machine running Debian, serving HTTPS with a self-signed certificate, which you prepared in the previous project.

Purpose

I am following this tutorial.

Using Chrome

Using Chrome Developer Tools

In the Developer Tools pane, click the Security tab.

In the Connections section, notice these three items, outlined in red in the image below.

• TLS 1.3 (lower versions don't support post-quentum encryption)
• TX25519 An elliptic curve key exchange protocol -- this will no longer be safe when powerful quantum computers exist
• AES_128_GCM Encryption method--this may also be broken when powerful quantum computers exist

Using Wireshark to Examine the HTTPS Handshake

Start sniffing on the interface that carries traffic from your host system to your virtual machine.

In Wireshark, at the top left, enter this display filter:

tcp.port==443

In Chrome, refresh this page:

https://yourname-https.net

Find the Client Hello packet.

Expand these items:

• Transport Layer Security
• TLSv1.3 Record Layer: Handshake Protocol: Client Hello
• Handshake Protocol: Client Hello
• Extension: supported_groups
• Supported Groups

This corresponds to X25519MLKEM768, a hybrid PQC algorithm combining X25519 (ECDH) with ML-KEM-768 (a PQC key encapsulation mechanism).

Server Hello

Expand these items:

• Transport Layer Security
• TLSv1.3 Record Layer: Handshake Protocol: Server Hello
• Handshake Protocol: Server Hello
• Extension: key_share
• Key Share extension
• Key Share Entry: Group: x25519, Key Exchange length: 32

Adding Post-Quantum Encryption to the Server

openssl version

Install Software

sudo apt update
sudo apt install git cmake libssl-dev ninja-build -y
git clone https://github.com/open-quantum-safe/oqs-provider.git
cd oqs-provider
./scripts/fullbuild.sh
sudo cmake --install _build

Run Tests

./scripts/runtests.sh

Configuring OpenSSL

sudo nano /etc/ssl/openssl.cnf

openssl_conf = openssl_init

Add the following lines at the end of the file, as shown below.

# PQC via OpenQuantumSafe
[provider_sect]
default = default_sect
oqsprovider = oqsprovider_sect
[default_sect]
activate = 1
[oqsprovider_sect]
activate = 1

Save the file with Ctrl+X, Y, Enter.

Viewing OpenSSL Providers

openssl list -providers

Viewing Key Exchange Algorithms

openssl list -kem-algorithms

This is the only post-quantum algorithm supported by default in current web browsers.

Enabling the X25519MLKEM768 group in Apache

sudo nano /etc/apache2/mods-enabled/ssl.conf

# Configure key exchange and key encapsulation mechanisms
 SSLOpenSSLConfCmd Curves X25519MLKEM768:X448:X25519:prime256v1

Save the file with Ctrl+X, Y, Enter.

Execute this command to restart Apache:

sudo service apache2 restart

Using Chrome Developer Tools

In the Developer Tools pane, click the Security tab.

In the Connections section, you should now see X25519MLKEM768, outlined in red in the image below.

Flag W 12.1: Server Hello (10 pts) Capture a TLS handshake in Wireshark. Find the Server Hello packet. Expand these items: Transport Layer Security TLSv1.3 Record Layer: Handshake Protocol: Server Hello Handshake Protocol: Server Hello Extension: key_share Key Share extension The flag is covered by a green rectangle in the image below.